Skip to content

Change the web-service fetch to include user-context by default#657

Open
StefanVanDyck wants to merge 2 commits intoAtlasOfLivingAustralia:developfrom
StefanVanDyck:provide-user-context-to-biocache-service
Open

Change the web-service fetch to include user-context by default#657
StefanVanDyck wants to merge 2 commits intoAtlasOfLivingAustralia:developfrom
StefanVanDyck:provide-user-context-to-biocache-service

Conversation

@StefanVanDyck
Copy link
Contributor

Related to: AtlasOfLivingAustralia/biocache-service#988

Make sure that all request to the biocache-service always include the user-context.
Needed for the biocache-service to make the rbac determination and make sure the user only sees the data he has access to.
Aside from the RBAC thing, it is probably a good idea to always propagate user-context anyway, should help to avoid "confused-deputy" problems.

@adam-collins
Copy link
Contributor

Revert the changes made the 2nd parameter wsAuth as it is unrelated to the user.

@adam-collins adam-collins self-requested a review March 1, 2026 21:08
@StefanVanDyck
Copy link
Contributor Author

StefanVanDyck commented Mar 2, 2026

Hey @adam-collins thanks for having a look.

The includeUser is necesary to make sure the biocache-service receives the access-token used by the original requesting user. (I think)
Which is what we want, so the biocache-service can see which roles the user has and what data to return.
(with the RBAC changes)

But I get this might be a change with unforeseen consequences, I am definitely not sure how this will affect other authentication setups.
Maybe I should make it a configuration thing?

Copy link
Contributor

@adam-collins adam-collins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 2nd parameter to getJsonElements, wsAuth, is for forwarding application JWT not user JWT. Changes to the wsAuth parameter need to be reverted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants