Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Add caveat for webapi admin session authentication bug #7393

Merged
merged 3 commits into from
Jun 11, 2020
Merged

Add caveat for webapi admin session authentication bug #7393

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e6eae25
Add caveat for known bug
sta1r Jun 11, 2020
4131c38
Grammar and formatting.
dobooth Jun 11, 2020
4c99610
Merge branch 'master' into AM/session-auth-edits
dobooth Jun 11, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions src/guides/v2.3/get-started/authentication/gs-authentication-session.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,11 @@ For example, if a customer is logged in to the Magento storefront and the [JavaS

`GET /rest/V1/customers/me`

Similarly, if an admin is logged in to the Magento Admin
and the JavaScript widget `Magento_Customer::group` API, details for the logged-in admin are fetched.
The web API framework establishes the identity of the admin user based on logged-in session information and authorizes access to the `Magento_Customer::group` resource.
Similarly, if an admin is logged in to the Magento Admin and the JavaScript widget invokes the `Magento_Customer::group` API, details for the logged-in admin are fetched. The web API framework establishes the identity of the admin user based on logged-in session information and authorizes access to the `Magento_Customer::group` resource.

{:.bs-callout-info}
The session based authentication functionality is restricted to only allow for AJAX calls and not direct browser requests due to security vulnerabilities. A developer can create a custom storefront widget that can issue requests without additional authentication steps.
{:.bs-callout-warning}
Admin session-based authentication is not currently possible for API endpoints.
The session based authentication functionality is restricted to AJAX calls. Direct browser requests cannot be made due to security vulnerabilities. A developer can create a custom storefront widget that can issue requests without additional authentication steps.

## Related topic

Expand Down