Page MenuHomePhabricator

/developer-settings does not guard against anon users
Closed, ResolvedPublicBUG REPORT

Description

List of steps to reproduce (step by step, including full links if applicable):

What happens?:
The view tries to load http://localhost:8000/api/oauth/authorized/?page=1 and gets a 401 response

What should have happened instead?:
The route should kick you out or display a notice that this feature only works when you are logged in without triggering the api call.

Event Timeline

One idea:

  • split the 3 tabs out into separate components
  • make the "client apps" tab that anons can see the default tab
  • guard the "register apps" and "authorized apps" tabs even being rendered based on authentication status

The 401 error being shown as "Oops! An error occurred: [object Object]" is also a bug. The JSON payload of the 401 response has a better message of "Authentication credentials were not provided." inside it.

Change 697868 had a related patch set uploaded (by Srishakatux; author: srishakatux):

[wikimedia/toolhub@main] Guard /developer-settings against anon users

https://gerrit.wikimedia.org/r/697868

The 401 error being shown as "Oops! An error occurred: [object Object]" is also a bug. The JSON payload of the 401 response has a better message of "Authentication credentials were not provided." inside it.

@bd808 I see that users.js is not relying at all on getFailurePayload. Can take this up as part of T268774 next.

Change 697868 merged by jenkins-bot:

[wikimedia/toolhub@main] Guard /developer-settings against anon users

https://gerrit.wikimedia.org/r/697868