title: REST API access control extract subject from access token vs. from path parameter
body: <p>The general idea in securing REST API in OAUTH is by using Authorization Bearer &lt;<code>access token</code>> header, typically a JWT, which has information about the subject, ie. <code>sub: u1</code>  with u1 is the userId in the database.</p>
  
  <p>With such access token, client app can access the different resources. Let's say an user has many cars, has many boats, etc...So, in RESTful manner, <code>/users</code> returns all users, <code>/users/:u1</code> returns data of user u1, <code>/users/:u1/cars/:c1</code> returns data of the car <code>c1</code> of user <code>u1</code>, <code>/users/:u1/boats/:b1</code> returns data of the boat <code>b1</code> of user <code>u1</code>, etc. </p>
  
  <p>My question is about <code>u1</code>. Shouldn't <code>u1</code> be extracted from the JWT access token instead because we know we can trust the JWT? In theory an app can use a JWT issued for user <code>u1</code>, but requesting access to <code>/users/:u2</code> which should be forbidden. </p>
  
  <p>One can make <code>/users/:u1</code> unavailable, and force client app to call <code>/users</code> instead and extract the <code>sub</code> from the JWT. However, calling <code>/users</code> to return data of <code>u1</code> breaks the RESTful pattern and its benefits (ie. http caching). </p>
  
  <p>What's the right approach? </p>
  
  <p>This probably an <code>authorization</code> framework on REST api question. JWT can only address <code>authentication</code> only. </p>