Working with policies

A common use case in API development is to allow users to manage their own information and contents. While the Users & Permissions plugin works great for providing us with role-based authentication, it does not provide an out-of-the-box strategy for allowing users to manage their own content. Instead, the decision is left to developers to handle this case according to the business requirements. Luckily, we do not need to reinvent the wheel to implement such logic in the API authentication flow. We can use Strapi's policies to customize the authentication and authorization flow.

A policy in Strapi is a function that can be executed before a request reaches a controller. Policies are mostly used for securing business logic easily. Policies are applied to a route using the policies array in the {content-type}/routes/{content-type}.js router file or the {content-type}/routes/{custom-file}.js custom router file:

// Example of policy in Core Router file...