Make sys/wrapping/lookup unauthenticated. #3084
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We still perform validation on the token, so if the call makes it through to this endpoint it's got a valid token (either explicitly specified in data or as the request token). But this allows introspection for sanity/safety checking without revoking the token in the process.
calvn
approved these changes
Jul 31, 2017
| // wrapping can always succeed. Note that sys/wrapping/lookup isn't | ||
| // contained here because using it would revoke the token anyways, so there | ||
| // isn't much point. | ||
| // wrapping can always succeed. |
There was a problem hiding this comment.
Should we add sys/wrapping/lookup to this policy now?
There was a problem hiding this comment.
You don't need it! Because it's unauthenticated.
There was a problem hiding this comment.
The wrapping validation function tests the validity of the token itself, but we then bypass the policy checks because it's an unauth endpoint. That's how we get around the use count decrementing.
We could make it an auth endpoint and add that policy but then we need to hard code exclusions from use count decrementing. Which doesn't seem great either.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We still perform validation on the token, so if the call makes it
through to this endpoint it's got a valid token (either explicitly
specified in data or as the request token). But this allows
introspection for sanity/safety checking without revoking the token in
the process.