This repository was archived by the owner on Mar 22, 2021. It is now read-only.
Fix security flaw and add Soft(optional) authentication feature#171
Open
Arinzeokeke wants to merge 8 commits intonsarno:masterfrom
Open
Fix security flaw and add Soft(optional) authentication feature#171Arinzeokeke wants to merge 8 commits intonsarno:masterfrom
Arinzeokeke wants to merge 8 commits intonsarno:masterfrom
Conversation
…est. All tests passed
… user uses authenticate_for directly. wrapper functions over authenticate_for for strict and soft authentications created to fix this issue.
…. Travis threw an error on that
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, here are my modifications in detail
Using authenticate_for directly for namespaced models(any model actually) doesn't send back an Unauthorized header when an invalid/no token is sent as authenticate_for doesn't check for that.
I added wrapper functions
set_authenticate_forandset_soft_authenticated_forto fix that issue for strict and optional authentications respectively.Some controllers may not require authentication but acts slightly different if authenticated.
Example: It may add extra(private or user-specific) values to JSON response if authenticated.
Modified
method_missinginauthenticable.rbto accept thesoft_authenticate_<entity>method to implement said behaviour.Also added
set_soft_authenticate_forfor same functionality as explained in 1.Added tests to ensure changes are working
Updated README