github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-31 01:17:16 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FIX: Don't redirect XHR/JSON requests when login is required (#15093)

Browse Source 
When redirecting to login, we store a destination_url cookie, which the user is then redirected to after login. We never want the user to be redirected to a JSON URL. Instead, we should return a 403 in these situations.

This should also be much less confusing for API consumers - a 403 is a better representation than a 302.
This commit is contained in:
David Taylor
2021-12-02 15:12:25 +00:00
committed by GitHub
parent 55cbc70f3f
commit cfb6199a95
4 changed files with 46 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spec/integration/api_keys_spec.rb
View File

@ -45,7 +45,7 @@ describe 'api keys' do
# Confirm not allowed for json
get "/latest.json?api_key=#{api_key.key}&api_username=#{user.username.downcase}"
expect(response.status).to eq(302)
expect(response.status).to eq(403)
end
context "with a plugin registered filter" do
@ -96,7 +96,7 @@ describe 'user api keys' do
# Confirm not allowed for json
get "/latest.json?user_api_key=#{user_api_key.key}"
expect(response.status).to eq(302)
expect(response.status).to eq(403)
end
it "can restrict scopes by parameters" do