Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Requests authenticated via api_key should not store session #3207

Closed
rafatower opened this issue Apr 15, 2015 · 0 comments
Closed

Requests authenticated via api_key should not store session #3207

rafatower opened this issue Apr 15, 2015 · 0 comments
Assignees
@rafatower
Milestone
Guarroman

Comments

@rafatower
Copy link
Contributor

We're storing a session in the frontend plus sending a response cookie back to the client.

This also introduces additional complexity to tests.
@rafatower rafatower self-assigned this Apr 15, 2015
@rafatower rafatower added this to the Guarroman milestone Apr 15, 2015
rafatower pushed a commit that referenced this issue Apr 15, 2015
Do not store session for api_key auth #3207
9edbdef
rafatower pushed a commit that referenced this issue Apr 15, 2015
Fix for current_viewer #3207
8866485 
The current_viewer is taken from the subdomain if the user was
previously authenticated. This covers api_key authentication (no
session).

Also we make sure to return nil if there's no authenticated user in the
context of the request. This is very important from a security
standpoint.
rafatower pushed a commit that referenced this issue Apr 16, 2015
Merge pull request #3208 from CartoDB/3207-no-session-when-api-key
2ca401e 
Do not store session for api_key auth #3207
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rafatower rafatower

Labels
None yet
Projects
None yet
Milestone
Guarroman
Development

No branches or pull requests
2 participants
@zenitraM @rafatower