From fda63e2ff627a876a3f49ed1e902c2548e5eba9f Mon Sep 17 00:00:00 2001 From: Christian Franke Date: Tue, 4 Apr 2023 10:29:56 +0200 Subject: [PATCH] docs: Fix authentication / authorization mixup `IsAuthenticatedOrReadOnly` authorizes users that are not authenticated for read-only access to resources. Therefore, they are unauthenticated users, not unauthorized users. --- docs/api-guide/permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/api-guide/permissions.md b/docs/api-guide/permissions.md index e70cc63be..5e0b6a153 100644 --- a/docs/api-guide/permissions.md +++ b/docs/api-guide/permissions.md @@ -165,7 +165,7 @@ This permission is suitable if you want your API to only be accessible to a subs ## IsAuthenticatedOrReadOnly -The `IsAuthenticatedOrReadOnly` will allow authenticated users to perform any request. Requests for unauthorized users will only be permitted if the request method is one of the "safe" methods; `GET`, `HEAD` or `OPTIONS`. +The `IsAuthenticatedOrReadOnly` will allow authenticated users to perform any request. Requests for unauthenticated users will only be permitted if the request method is one of the "safe" methods; `GET`, `HEAD` or `OPTIONS`. This permission is suitable if you want to your API to allow read permissions to anonymous users, and only allow write permissions to authenticated users.