Authorization / ownership

Understand the idea

For personal todos, the authenticated user id is the owner. Queries for a single task include both task id and owner id. List queries filter by owner. Create assigns the verified owner; update cannot transfer it.

A concrete example

findByIdAndOwnerId(taskId, jwt.getSubject())

In the application

PersonalTodoService makes owner-filtered access mandatory for reads, updates, and deletes. Bob cannot access Alice’s id.

Hiding another user’s task in React is not authorization. An attacker can call the API directly.

Related concepts

• Authentication
• JWT · JSON Web Token
• Repository
• DTO · Data Transfer Object