Mercurial > p > roundup > code
comparison roundup/cgi/client.py @ 8175:bd628e64725f
Documentation and fix for REST headers
issue2551372 - Better document necessary headers for REST and fix
logging to log missing Origin header.
| author | Ralf Schlatterbeck <rsc@runtux.com> |
|---|---|
| date | Wed, 04 Dec 2024 10:45:26 +0100 |
| parents | 3f0f4746dc7e |
| children | e84d4585b16d |
comparison
equal
deleted
inserted
replaced
| 8174:5ea419c1d571 | 8175:bd628e64725f |
|---|---|
| 717 # verify Origin is allowed on all requests including GET. | 717 # verify Origin is allowed on all requests including GET. |
| 718 # If a GET, missing origin is allowed (i.e. same site GET request) | 718 # If a GET, missing origin is allowed (i.e. same site GET request) |
| 719 if not self.is_origin_header_ok(api=True): | 719 if not self.is_origin_header_ok(api=True): |
| 720 if 'HTTP_ORIGIN' not in self.env: | 720 if 'HTTP_ORIGIN' not in self.env: |
| 721 msg = self._("Required Header Missing") | 721 msg = self._("Required Header Missing") |
| 722 err = 'Origin header missing' | |
| 722 else: | 723 else: |
| 723 msg = self._("Client is not allowed to use Rest Interface.") | 724 msg = self._("Client is not allowed to use Rest Interface.") |
| 725 err = 'Unauthorized for REST request' | |
| 724 | 726 |
| 725 # Use code 400. Codes 401 and 403 imply that authentication | 727 # Use code 400. Codes 401 and 403 imply that authentication |
| 726 # is needed or authenticated person is not authorized. | 728 # is needed or authenticated person is not authorized. |
| 727 # Preflight doesn't do authentication. | 729 # Preflight doesn't do authentication. |
| 728 output = s2b( | 730 output = s2b( |
| 729 '{ "error": { "status": 400, "msg": "%s" } }' % msg) | 731 '{ "error": { "status": 400, "msg": "%s" } }' % msg) |
| 730 self.reject_request(output, | 732 self.reject_request(output, |
| 731 message_type="application/json", | 733 message_type="application/json", |
| 732 status=400) | 734 status=400) |
| 735 logger.error(err) | |
| 733 return | 736 return |
| 734 | 737 |
| 735 # Handle CORS preflight request. We know rest is enabled | 738 # Handle CORS preflight request. We know rest is enabled |
| 736 # because handle_rest is called. Preflight requests | 739 # because handle_rest is called. Preflight requests |
| 737 # are unauthenticated, so no need to check permissions. | 740 # are unauthenticated, so no need to check permissions. |