Skip to content

Fix: secutiry #183

Description

@StephanUnfried

HTMLClient:

  1. Change die top navigation (My Profile My Contexts My Resources My Groups) from a window.location model to a model that supports headers.
    /server/src/main/resources/webcontent/js/navigation.js
  2. When navigating add the authentication token to the header: headers : {"Authorization" : localStorage.getItem("token"),}
  3. In the corresponding rest interfaces and their corresponding helper classes use the token to identify the user and authenify him.
    org.openape.ui.velocity.controller.[name]
    org.openape.ui.velocity.requestHandler.[name]
    For authentication use our auth service
    /server/src/main/java/org/openape/server/auth/AuthService.java
  4. change the direct Database access, through DatabaseConnection.java, to a route through the usual rest interfaces. A get on the root path of each context rest interface returns a list of all (owned and public) contexts.

https://github.com/REMEXLabs/OpenAPE/tree/fixAminSectionAccess

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions