[Bug]: User is not added to the running thread when authenticating API Tokens at portal and host levels

Open
  • Is something wrong?
#7,596 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 3 days

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Domain
api, authentication, backend

Research direction

Start by tracing API token authentication and the GetCurrentUser call that initializes the request's user identity. Focus on the portal- and host-level token paths, and identify where the token creator's user should be applied so downstream code can access that identity. Verify that user-level tokens still behave as before and add or run the relevant authentication tests; the issue names no specific test files.

Written by the indexing model from the issue text.

Description

Status: New
Is there an existing issue for this?
  • I have searched the existing issues
What happened?

When securing endpoints with ApiTokens we can specify whether these tokens should operate at user, portal or host level. And the token being used is tied to this scope (and subsequently also to specific APIs). For a token at User level, we add that user to the thread and in subsequent calls to GetCurrentUser you will see this user. But for tokens at Portal and Host levels we do not add the user (that created the token). This has several disadvantages:

  1. In code that is being called we now cannot check the user's identity any longer
  2. For traceability in this downstream code it's useful to also know who owns the token

All tokens are created by a user (could be an admin or host user). Although the token could be implemented in a m2m situation, I believe we should still impersonate the creating user on the api endpoint.

Steps to reproduce?
  1. Create host token
  2. Use in a method that is protected by Host level Api Token
  3. Step through code and notice how UserInfo is the default inititialized (anonymous) user
Current Behavior

No response

Expected Behavior

No response

Relevant log output
Anything else?

No response

Affected Versions

10.4.1 (latest release)

What browsers are you seeing the problem on?

No response

Code of Conduct
  • I agree to follow this project's Code of Conduct
Dominant language
C#
Stars
1.1k
Forks
791
Avg merge
4d 5h
Merged PRs (30d)
27

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dnnsoftware/Dnn.Platform

All issues in dnnsoftware/Dnn.Platform

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.