Open API - security update #14868
Merged
Open API - security update #14868
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…urity works the way we expect, do not redirect API requests.
|
QA Wolf here! As you write new code it's important that your test coverage is keeping up. |
samwho
requested changes
Oct 25, 2024
| @@ -833,7 +831,8 @@ | |||
| "type": "string", | |||
| "enum": [ | |||
| "static", | |||
| "dynamic" | |||
| "dynamic", | |||
| "ai" | |||
There was a problem hiding this comment.
Need to update the description field here as well.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
@shogunpurple noticed there was an issue with using the public API to access development apps from non-builder roles, when this occurred the response was a re-direct as we expect in the browser, however this makes little sense in an API call.
I've updated the test cases a bit around the public API to make this a testable scenario, as well as updating
currentapp.tsto 403 in these cases rather than a re-direct, by detecting it is using an API key.I've also removed the
isTestwhich was hiding this from our test cases and instead check if the call is coming from a browser.Final small update is the OpenAPI spec was a little hard to use as you had to work out all the variables you needed, I've defaulted these so that when imported to tools that support OpenAPI specifications it shows all the variables listed with descriptions, making it a lot quicker to get up and running.