12 Commits (507fa44804d922ecda202c6f187e46d0118b263e)

Author	SHA1	Message	Date
Oliver Günther	7d8526d77f	Allow Session requests on GET without frontend header ... This is required since now attachments are displayed through apiv3 URLs. GET requests are safe to request without the header present.	6 years ago
ulferts	c88b0b85c4	return proper WWW Authenticate header on missing credentials (#6150) ... An anonymous_fallback is introduced and registered to be the last strategy for warden. That strategy will always apply and it will always return the anonymous user. The better way would be to only apply the strategy if login is not required. That way we would still be able to return a 403 when credentials are missing but would no longer need to have 401 handlers outside of warden. That duplicity caused the missing header in the first place. It would however require us to handle the realm in the strategy and by that increase the coupling between the strategy and the application. [ci skip]	7 years ago
Oliver Günther	988d96c241	Restrict session API authentication to X-Requested-With	7 years ago
Oliver Günther	5d84add246	Expire sessions in warden auth scope	7 years ago
Oliver Günther	0fbb9c6168	Provide configuration option for basic auth API access ... This adds: 1. A configuration option `apiv3_enable_basic_auth` to determine whether v3 may use the basic auth strategies 2. Extensions to the warden strategies to disable them unless configured	8 years ago
Alex Coles	a6212fb304	Fix syntax (w/Rubocop) in lib code ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Markus Kahl	1d0146dfda	amended comment	10 years ago
Markus Kahl	be08d64991	do nothing when configuration is missing altogether	10 years ago
Markus Kahl	2a465785d1	allow digit-only but not empty passwords	10 years ago
Markus Kahl	28c81dfad0	use existing method to find user via api key	10 years ago
Markus Kahl	4957750270	wrapped comment	10 years ago
Markus Kahl	7e40c11ca4	moved strategies; refactoring	10 years ago