Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

API allows access to resources without Auth token #1410

Closed
atextor opened this issue Feb 21, 2019 · 0 comments
Closed

API allows access to resources without Auth token #1410

atextor opened this issue Feb 21, 2019 · 0 comments
Labels
bug Repository
Projects
0.11 (E06.2019)
Milestone
0.11

Comments

@atextor
Copy link
Contributor

atextor commented Feb 21, 2019

The API allows read-access to resources without any authentication, for example:
GET /api/v1/attachments/{modelId}/files/somefile.txt works without an Authorization header, i.e. retrieves the file. When sending an invalid token in the header, the request is correctly rejected with a 401 response.
@aedelmann aedelmann modified the milestones: 0.10, 0.11-M1 Feb 21, 2019
@aedelmann aedelmann added this to To do in 0.11 (E06.2019) Feb 21, 2019
@aedelmann aedelmann moved this from To do to In progress in 0.11 (E06.2019) May 29, 2019
@aedelmann aedelmann moved this from In progress to To do in 0.11 (E06.2019) May 30, 2019
@aedelmann aedelmann moved this from To do to In progress in 0.11 (E06.2019) Jun 7, 2019
erlemantos pushed a commit to bosch-io/vorto that referenced this issue Jun 10, 2019
Fixes eclipse#1410 - API allows access to resources without Auth token
8d85269 
Signed-off-by: Erle Czar Mantos <erleczar.mantos@bosch-si.com>
@aedelmann aedelmann moved this from In progress to Done in 0.11 (E06.2019) Jun 10, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Repository
Projects
No open projects
0.11 (E06.2019)
  
Done
Milestone
0.11
Development

No branches or pull requests
2 participants
@atextor @aedelmann