--- title: "Designing safer listItems and getItem permissions" url: https://daily.dev/posts/designing-safer-listitems-and-getitem-permissions-knn0orlvr source_url: https://advancedweb.hu/designing-safer-listitems-and-getitem-permissions type: article source: "Advanced Web Machinery" published: 2026-05-09T18:14:06.353Z updated: 2026-05-09T18:14:44.039Z tags: ["architecture", "authorization"] reading_time: 13 upvotes: 81 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Designing safer listItems and getItem permissions **[Advanced Web Machinery](https://daily.dev/sources/advancedweb)** · 13 min read · 81 upvotes · 0 comments ## Summary When building APIs with both list and get-by-ID endpoints that return the same objects, using a single permission type (either listItems or getItem) avoids subtle security issues. The post demonstrates how token-based pagination combined with per-item authorization checks can leak information about restricted items through empty pages and nextToken signals. The safer approach is to authorize the list operation before querying the database, passing filter parameters as authorization context. The post also covers best practices: list endpoints should use list permissions, list responses should return minimal data (not full objects), and when full objects are returned in lists, use only list-level policies to avoid permission duplication. AWS S3 and KMS are cited as examples of good API design where list and get operations return different data shapes with separate permissions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Why Developers Write s3:\* Instead of Least Privilege Policies](https://daily.dev/posts/why-developers-write-s3-instead-of-least-privilege-policies-kasvctbst) · AWS Fundamentals · 0 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/designing-safer-listitems-and-getitem-permissions-knn0orlvr)