-
Story
-
Resolution: Fixed
-
Blocker
-
-
1.0-m12, 1.0-pre-beta-1
In Scope
- Change authentication so that it works via JWT only
- Remove authentication via cookie
- Ensure that the frontend continues to work when JWT is enabled (You may need to open another ticket to get help from the frontend team)
- Solution should be cURL friendly
- blocks
-
JENKINS-36851 Favourite stars should be hidden for the anonymous user
-
- Closed
-
-
JENKINS-36852 Dashboard should use JWT to find the authenticated user
-
- Resolved
-
- is blocked by
-
-
- Closed
-
[JENKINS-35783] REST API must only be authenticated using JWT
| Epic Link | New: UX-165 [ 25873 ] |
| Summary | Original: REST API should only be authenticated using JWT | New: REST API must only be authenticated using JWT |
| Description |
Original:
In Scope * Change authentication so that it works via JWT only * Remove authentication via cookie * Consider allowing basic auth if no JWT is available ([~vpandey] is that a good thing todo as a fallback? What is the best practice?) * Ensure that the frontend continues to work when JWT is enabled (You may need to open another ticket to get help from the frontend team) |
New:
In Scope * Change authentication so that it works via JWT only * Remove authentication via cookie * Ensure that the frontend continues to work when JWT is enabled (You may need to open another ticket to get help from the frontend team) |
Ivan Meredith
added a comment - bwalding why does basic auth open csrf on an application/json poat? Only thing I can think of is the URL scheme but you'd need a password for that e.g. http://demo:securepassword@blueocean.io/blue/rest/
well, the browser automatically sends the header in csrf. Which isnt true for JWT or Bearer. But we specifically require application/json header on the rest api to protect agaist csrf,
Not that I am against JWT exactly, its just not as curl friendly i think? if it is curl friendly ignore me.
Ivan Meredith
added a comment - - edited well, the browser automatically sends the header in csrf. Which isnt true for JWT or Bearer. But we specifically require application/json header on the rest api to protect agaist csrf,
Not that I am against JWT exactly, its just not as curl friendly i think? if it is curl friendly ignore me. Because hackers.com can make a Javascript call and the Basic Auth credentials will be sent to mycorporatesite.com if the user has entered them recently.
$.ajax({
type: "POST",
url: "https://mycorporatesite.com/blue/delete-all-my-stuff",
data: "",
xhrFields: {
withCredentials: true
},
success: function(s) { console.log('success', s); },
dataType: 'application/json'
});
My base position would be to leave Basic Auth disabled until you have a concrete use case.
I don't think general convenience is a valid use-case - as it re-opens the door on CSRF attacks.
(you might be able to get around this by doing Bearer Authentication headers rather than Basic Auth headers - but understand the use-case first)