Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get rid of unsafe function in AuthedContext #256

Open
chuwy opened this issue Oct 7, 2018 · 0 comments
Open

Get rid of unsafe function in AuthedContext #256

chuwy opened this issue Oct 7, 2018 · 0 comments
Labels
Milestone

Comments

@chuwy
Copy link
Contributor

chuwy commented Oct 7, 2018

AuthedContext.getAuth throws an exception when underlying AuthMiddleware returns None (or if middleware was not applied). Was initially raised here.

Here's how I first time stumbled upon this.

  1. I wanted to have a route /entities without authorization required (but instead behavior would be slightly different when user is not anonymous)
  2. My authorization logic was: request.headers.get("apikey").flatMap(db.getPermissionById), so whenever apikey was not present in DB or request - AuthMiddleware returned None
  3. Whenever AuthMiddleware returned None - I got NoSuchElementException in getAuth

I guess my design goals in 1st and 2nd points were slightly invalid and I got fixed this by changing authorization logic to always return something, e.g. Anonymous even when no apikey is available and using url >>> Auth.auth(), but it made my endpoint to officially require authorization.

  1. If design of AuthMiddleware is to never return None - we need to remove AuthedContext.getAuth entirely and use only >>> Auth.auth()
  2. If it is okay to return None for "anonymous users" - we need to make it return Option[AuthInfo] (this is what I did in 0.19 #253)
  3. Somehow make it impossible to call authentication method without AuthMiddleware being applied (I guess this is a long-term goal of this ticket)
@chuwy chuwy mentioned this issue Oct 7, 2018
6 tasks
chuwy added a commit to chuwy/rho that referenced this issue Oct 29, 2018
@zarthross zarthross added this to the v0.19.0-M2 milestone Oct 30, 2018
@zarthross zarthross modified the milestones: v0.19.0-M2, v0.19.0 May 2, 2019
@zarthross zarthross added the bug label May 2, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants