POST / PUT with no explicit id in request
In the context of POST/PUT endpoints, is it ok to retrieve the id from the authentication token instead of forcing the user to send it via a path variable? For example, PUT /api/users that updates the logged-in user's info would arguably be more convenient for clients than PUT /api/users/{id}. Assuming, of course, the said token contains a userid claim. Another idea is to have a forwarding endpoint: PUT /api/users would forward to PUT /api/users/{id} passing the userid claim.
In the context of POST
/PUT
endpoints, is it ok to retrieve the id from the authentication token instead of forcing the user to send it via a path variable?
For example, PUT /api/users
that updates the logged-in user's info would arguably be more convenient for clients than PUT /api/users/{id}
. Assuming, of course, the said token contains a userid
claim.
Another idea is to have a forwarding endpoint: PUT /api/users
would forward to PUT /api/users/{id}
passing the userid
claim.