Hi guys, is there something in Directus to allow a user to access items of a collection if he has an ID, but not to list all items? I can’t find that in Roles, I have the latest version 11.8
Do you think it may add a security concern, such as a user who has access to a particular item but should not be able to list all other items, in case of privacy?
If users are not supposed to see some items then security wise it’s best to configure permissions to prevent read access to those alltogether. Items will only be listed if a user has permission to them, only disabling the listing does not actually prevent the user from accessing that privacy/sensitive data if they somehow guess or know the ID of that item.
Not as of the current version (v11.8). Read permissions apply to both listing and individual reads. We’ve got a feature request in place for this, so I’ll add you to it.