title: How do I secure data access in my new API?
body: <p>I am designing an API, and I'd like to ask a few questions about how best to secure access to the data.</p>
  
  <p>Suppose the API is allowing access to artists. Artists have albums, that have songs.</p>
  
  <p>The users of the API have access to a subset of all the artists. If a user calls the API asking for some artist, it is easy to check if the user is allowed to do so.</p>
  
  <p>Next, if the user asks for an album, the API has to check if the album belongs to an artist that the user is allowed to access. Accessing songs means that the API has to check the album and then the artist before access can be granted.</p>
  
  <p>In database terms, I am looking at an increasing number of joins between tables for each additional layer that is added. I don't want to do all those joins, and I also don't want to store the user id everywhere in order to limit the number of joins.</p>
  
  <p>To work around this, I came up with the following approach.</p>
  
  <p>The API gives the user a reference to an object, for instance an artist object. The user can then ask that artist object for the albums, which returns a list object. The list object can be traversed, and album objects can be obtained from it. Likewise, from an album object a songlist object can be obtained and from that, the individual song objects.</p>
  
  <p>Since the API trusts the artist object, it also trusts any objects (albums in this case) that the user gets from it, without further checks. And so forth for all the other objects. So I am delegating the security/trust to objects down the chain.</p>
  
  <p>I would like to ask you what you think of it, what's good or bad about it, and of course, how you would solve this "problem".</p>
  
  <p>Second, how would you approach this if the API should be RESTful? My approach seems less applicable in that case.</p>