Add a comment regarding read/write control via HTTP verbs #863 (#7909)

* adding a comment regarding read/write control via HTTP verbs #863 Signed-off-by: AntonEliatra <[email protected]> * adding a comment regarding read/write control via HTTP verbs #863 Signed-off-by: AntonEliatra <[email protected]> * Update rest-layer-authz.md Signed-off-by: AntonEliatra <[email protected]> * Update _security/access-control/rest-layer-authz.md Signed-off-by: Naarcha-AWS <[email protected]> --------- Signed-off-by: AntonEliatra <[email protected]> Signed-off-by: Naarcha-AWS <[email protected]> Co-authored-by: Naarcha-AWS <[email protected]>
opensearch-project · Aug 7, 2024 · a0bf74a · a0bf74a
1 parent 237e839
commit a0bf74a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/_security/access-control/rest-layer-authz.md b/_security/access-control/rest-layer-authz.md
@@ -16,6 +16,8 @@ Developers, on the other hand, will need to understand the ideas behind `NamedRo
 
 The benefits of using the REST layer for authorization include the ability to authorize requests at the REST layer and filter out unauthorized requests. As a result, this decreases the processing burden on the transport layer while allowing granular control over access to APIs.
 
+Some read operations, such as  [scroll]({{site.url}}{{site.baseurl}}/api-reference/scroll/), manage state. Therefore, it is recommended to control read and write access using the Security plugin [permissions]({{site.url}}{{site.baseurl}}/security/access-control/permissions/), instead of allowing/blocking HTTP request verbs.
+
 You must have the Security plugin enabled to use REST layer authorization.
 {: .note }