search

lotusbase / lotus.au.dk

Lotus Base website
https://lotus.au.dk
MIT License
2 stars 1 forks source link

Fix issue where passthrough is enabled on all API routes #31

Closed terrymun closed 6 years ago

terrymun commented 6 years ago

An incorrect configuration causes all calls to v1 API to passthrough, resulting in no JWT authentication.

terrymun commented 6 years ago

This issue also fixes a bug discovered during the process of troubleshooting: basically the same secret is used to sign JWT used for API keys and user logic, which is unsafe (users can copy API key and pass it to the Authorization header, and that will be marked as valid).