[Bug]: User is not added to the running thread when authenticating API Tokens at portal and host levels

Aperta
  • Qualcosa non va?
#7,596 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 3 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Ambito
api, authentication, backend

Direzione di ricerca

Start by tracing API token authentication and the GetCurrentUser call that initializes the request's user identity. Focus on the portal- and host-level token paths, and identify where the token creator's user should be applied so downstream code can access that identity. Verify that user-level tokens still behave as before and add or run the relevant authentication tests; the issue names no specific test files.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Status: New
Is there an existing issue for this?
  • I have searched the existing issues
What happened?

When securing endpoints with ApiTokens we can specify whether these tokens should operate at user, portal or host level. And the token being used is tied to this scope (and subsequently also to specific APIs). For a token at User level, we add that user to the thread and in subsequent calls to GetCurrentUser you will see this user. But for tokens at Portal and Host levels we do not add the user (that created the token). This has several disadvantages:

  1. In code that is being called we now cannot check the user's identity any longer
  2. For traceability in this downstream code it's useful to also know who owns the token

All tokens are created by a user (could be an admin or host user). Although the token could be implemented in a m2m situation, I believe we should still impersonate the creating user on the api endpoint.

Steps to reproduce?
  1. Create host token
  2. Use in a method that is protected by Host level Api Token
  3. Step through code and notice how UserInfo is the default inititialized (anonymous) user
Current Behavior

No response

Expected Behavior

No response

Relevant log output
Anything else?

No response

Affected Versions

10.4.1 (latest release)

What browsers are you seeing the problem on?

No response

Code of Conduct
  • I agree to follow this project's Code of Conduct
Lingua principale
C#
Stelle
1.1k
Fork
791
Merge medio
5g 7h
PR unite (30g)
29

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di dnnsoftware/Dnn.Platform

Tutte le issue di dnnsoftware/Dnn.Platform

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.