search

movableink / doorman

HTTP Proxy + OAuth
MIT License
167 stars 52 forks source link

Is username or email available to backend? #46

Closed pataquets closed 8 years ago

pataquets commented 8 years ago

If username is (or can be) made available to the backend server, for example via an added HTTP header, backend apps would benefit a lot. I didn't found anything in the docs.

mnutt commented 8 years ago

It's actually currently possible for the backend service to access the user's session cookie, which gets passed through. If the backend is using node it's just a matter of using the cookie-session module. The cookie is signed with a secret by doorman, but just viewing the contents doesn't necessarily need the secret.

This is obviously sub-optimal. Ideally we could pass a header to the backend, like you suggest. (I'd be happy to look at a PR for this) We'd just need each module to define what 'username' means.

mnutt commented 8 years ago

I just merged in this PR: https://github.com/movableink/doorman/pull/43 which should solve this.

pataquets commented 8 years ago

Thank you!