Allow authentication via URI query parameter #641
Labels
Comments
This was referenced Aug 25, 2024
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 1, 2024
Allows API authentication via URI query param for badge requests as an alternative to header authentication because typical use cases for badges do not easily allow header injection. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 1, 2024
Update tests to focus on API authentication via URI query parameter, but keep some tests that test header authentication as that remains an option. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 3, 2024
Allows API authentication via URI query param for badge requests as an alternative to header authentication because typical use cases for badges do not easily allow header injection. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 3, 2024
Update tests to focus on API authentication via URI query parameter, but keep some tests that test header authentication as that remains an option. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
|
Implemented via #642 |
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 11, 2024
Allows API authentication via URI query param for badge requests as an alternative to header authentication because typical use cases for badges do not easily allow header injection. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
SaberStrat
pushed a commit
to SaberStrat/dependency-track
that referenced
this issue
Sep 11, 2024
Update tests to focus on API authentication via URI query parameter, but keep some tests that test header authentication as that remains an option. Requires stevespringett/Alpine#641 Signed-off-by: Kirill.Sybin <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently, alpine-server's
AuthenticationFilterchecks only for a headerX-API-Keyfor an API key. However, there are use cases for clients that cannot pass a header or only with difficulty.One such case are SVG badges. More specifically, this would be a requirement for DependencyTrack/dependency-track#3596.
This enhancement suggests allowing an API-key to be passed via URI query parameter instead of a header. I'd gladly submit a PR myself.
Question is, should this be an alternative to the header that's always available, or should this be enabled explicitly?
The text was updated successfully, but these errors were encountered: