Skip to content

Allow API authentication parameters to be passed in a header #1342

Description

@philayres

This requirement is a short term security hardening measure, to mitigate against leaking of API tokens used to access ReStructure servers.

As an alternative to the use of the URL params user_email=test@abc.tst&user_token=abcdef123, these should be optionally passed with an HTTP header of the form Authorization: Bearer STA:<user_email>:<user_token>

STA indicates that this is a Simple Token Authentication username/user token.

Related to a longer term plan for the Simple Token Authentication gem (see #431) and general discussion about user tokens (#1076). This issue doesn't cover all of the issues, but acts as a short term stopgap measure.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or requestsecuritySecurity issue or CVE in dependency

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions