bastilian / AAAPI

Async Action API
0 stars 1 forks source link

Make jobs status available only to user who initiated it #25

Open gkarat opened 1 year ago

gkarat commented 1 year ago

This is one of the authorization aspects we could implement in MVP: to make sure we don't disclose information to other users. If user A creates a job J1, then only A is able to request status of J1 through /async and /websocket methods. Other users have to get 404.

This can be done by using Basic Auth and associating jobs with usernames.