title: How to prevent unauthorized access when creating a REST API?
body: <p>If my API allows GET requests such as follows :</p>
  
  <p><a href="http://myHost:3000/content/info/12" rel="nofollow noreferrer">http://myHost:3000/content/info/12</a></p>
  
  <p>Which would return information pertaining to an item identified uniquely by the number 12. Let's say a user has the right to view item 12, but there is nothing to stop them from making random GET requests with item numbers such as 13, 27, 11 which may return data that doesn't belong to them. Is there a way to prevent them form accessing data that does not belong to them via GET or POST requests ? I know that I can have each request accompany some unique user related piece of info(i.e. username) and cross check that with database to see if the user indeed has the right to view the item before sending the data, but that seems inefficient. What is the correct way to do this ?</p>