Change the web-service fetch to include user-context by default#657
Conversation
|
Revert the changes made the 2nd parameter |
|
Hey @adam-collins thanks for having a look. The But I get this might be a change with unforeseen consequences, I am definitely not sure how this will affect other authentication setups. |
adam-collins
left a comment
There was a problem hiding this comment.
The 2nd parameter to getJsonElements, wsAuth, is for forwarding application JWT not user JWT. Changes to the wsAuth parameter need to be reverted.
Related to: AtlasOfLivingAustralia/biocache-service#988
Make sure that all request to the biocache-service always include the user-context.
Needed for the biocache-service to make the rbac determination and make sure the user only sees the data he has access to.
Aside from the RBAC thing, it is probably a good idea to always propagate user-context anyway, should help to avoid "confused-deputy" problems.