You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently data added to the request object via calling the add (or addMultiple) method on an instance of the Request class the data is retrieved the same way as data from the http request
Reason for change:
you can not have a request body field with the same key as context data added to the request
in certain circumstances this could result in a potential vulnerability in which data can be sent in the request body that otherwise would be assigned based on certain permissions later in the request lifecycle. Ex. you could have a middleware that conditionally adds the CAN_WRITE key to the request object by calling the add method. Someone could simply add the CAN_WRITE key to a request object and there would be no way for the app to distinguish the two. This can be defended by validating the request body and/or always setting the CAN_WRITE flag to false before conditionally assigning it to true
Solution
add the following methods to the Request class addToContext, mergeIntoContext, getFromContext and getFromContextOrFail
deprecate add and addMultiple
The text was updated successfully, but these errors were encountered:
* feat(Request and App handler): Add ability for custom request deserialization and improve request ob
BREAKING CHANGE: Request class has changed
* test(Request and App): finsih updating request and app classes
add functinality to support future features outlined in issue #73
re #86
* refactor(request objects): change params, query string, and headers to be es6 maps
BREAKING CHANGE: must now pass headers and query string through as es6 maps
* build(typescript version bump): updated to latest stable typescript version 3.5.x
* docs(rejadme):
Currently data added to the request object via calling the
add
(oraddMultiple
) method on an instance of theRequest
class the data is retrieved the same way as data from the http requestReason for change:
CAN_WRITE
key to the request object by calling theadd
method. Someone could simply add theCAN_WRITE
key to a request object and there would be no way for the app to distinguish the two. This can be defended by validating the request body and/or always setting theCAN_WRITE
flag to false before conditionally assigning it to trueSolution
Request
classaddToContext
,mergeIntoContext
,getFromContext
andgetFromContextOrFail
add
andaddMultiple
The text was updated successfully, but these errors were encountered: