search

adsabs / adsws

ADS web services
Other
2 stars 15 forks source link

third-party services that are API clients should forward user's token #37

Closed vsudilov closed 9 years ago

vsudilov commented 9 years ago

References https://github.com/aholachek/vis-services/issues/5

vsudilov commented 9 years ago

Implemented a hackish solution: if X-Forwarded-Authorization is present in request.headers, check if request.oauth.client.client_id is within a hardcoded list of known/approved clients. If it is, set the ratelimit scope function to a random salt.