fix(api): allow unauthenticated OPTIONS (CORS preflight) requests - #704
Open
Manny7717 wants to merge 1 commit into
Open
fix(api): allow unauthenticated OPTIONS (CORS preflight) requests#704Manny7717 wants to merge 1 commit into
Manny7717 wants to merge 1 commit into
Conversation
CORS preflight requests always omit credentials, so the API must answer them without requiring authentication (Fetch spec). The API views previously applied IsAuthenticated to every method, returning 401 on OPTIONS. Adds an IsAuthenticatedOrOptions permission that passes OPTIONS through and uses it on all API views. Closes Exodus-Privacy#319
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
CORS preflight requests always use credentials mode
omit, so the API must answerOPTIONSrequests without requiring authentication (per the Fetch spec). Previously every API view appliedIsAuthenticatedto all methods, so a preflight returned401(repro in #319:curl -X OPTIONS .../api/search/test→{\"detail\":\"Authentication credentials were not provided.\"}).Change
IsAuthenticatedOrOptionspermission: passesOPTIONSthrough, delegates toIsAuthenticatedfor everything else.restful_api/views.py(regular and admin-gated views). Authenticated endpoints are unchanged: GET/HEAD/POST/etc. still require a valid token.Tests
test_options_preflight_does_not_require_auth: unauthenticatedOPTIONS /api/applicationsnow returns 200 (was 401, verified by running the test without the fix).manage.py test restful_api→ 41/41 OK; full suite → 69/69 OK; flake8 clean.