Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix: destination cache vulnerablity #1770

Merged
merged 4 commits into from
Nov 5, 2021
Merged

Fix: destination cache vulnerablity #1770

merged 4 commits into from
Nov 5, 2021
+177 −18

Conversation

jjtang1985
Copy link
Contributor

@jjtang1985 jjtang1985 commented Nov 5, 2021 •
edited
Loading

  • Switch the default isolation strategy from IsolationStrategy.Tenant to IsolationStrategy.Tenant_User, when setting useCache to true for destination lookup functions like getDestination.
  • Disable destination cache, when the JWT does not contain necessary information. For example, when using IsolationStrategy.Tenant_User, the JWT has to contain both tenant id and user id.

Closes SAP/cloud-sdk-backlog#438
Closes SAP/cloud-sdk-backlog#439

FrankEssenberger
FrankEssenberger approved these changes Nov 5, 2021
View reviewed changes
Copy link
Contributor

@FrankEssenberger FrankEssenberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jjtang1985 jjtang1985 marked this pull request as ready for review November 5, 2021 13:50
@jjtang1985 jjtang1985 enabled auto-merge (squash) November 5, 2021 13:57
@FrankEssenberger FrankEssenberger mentioned this pull request Nov 5, 2021
Closed
@jjtang1985 jjtang1985 merged commit fe1ba94 into main Nov 5, 2021
@jjtang1985 jjtang1985 deleted the fix-dest-cache-vul branch November 5, 2021 14:05
@jjtang1985 jjtang1985 mentioned this pull request Nov 8, 2021
Merged
marikaner pushed a commit that referenced this pull request Nov 8, 2021
@jjtang1985 @FrankEssenberger
Fix: destination cache vulnerablity #1770 (#1779)
6f0fcb9 
* cherry pick + remove deprecated functions

* missing changelog

* fix tests

* fix tests 2

Co-authored-by: d068544 <frank.essenberger@sap.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FrankEssenberger FrankEssenberger FrankEssenberger approved these changes

@marikaner marikaner Awaiting requested review from marikaner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@jjtang1985 @FrankEssenberger