search

azavea / grout-2018-fellowship

This is a (possibly temporary) issue-tracking repo for the Grout fellowship in 2018; there's not anticipated to be much if any code here
2 stars 1 forks source link

Restrict HTTP write methods in the Grout Server API #41

Closed jeancochrane closed 6 years ago

jeancochrane commented 6 years ago

Currently, Grout Server is configured to permit access to all HTTP methods from any user; it assumes that, like DRIVER, your API is only accessible to authenticated users.

It would be more useful to set the default permissions to IsAuthenticatedOrReadOnly, which would allow anyone to use read-only methods but would restrict write methods to logged-in users.

jeancochrane commented 6 years ago

Done in https://github.com/azavea/grout-server/pull/6.