Update fetch to pass cookie to server #63
Conversation
* check session for correct ORCID * otherwise, 403 * issue #62
| @@ -23,7 +23,8 @@ var Issue = React.createClass({ | |||
| var url = '/papers/' + path[path.length-2] + '/' + path[path.length-1] + '/users/' + orcid + '/badges/' + badge; | |||
|
|
|||
| fetch(url, { | |||
| method: 'post' | |||
| method: 'post', | |||
| credentials: 'same-origin' | |||
There was a problem hiding this comment.
|
@wjrsimpson -- do you have time to review? This should answer your security concerns from our last call |
|
Hi Abi, Yes, I reviewed and did some basic testing locally. I tried to create a badge using curl a) without cookies and b) with cookies but a different ORCID in the URL and got a 403 response for both. So, this addresses the concern I raised in the call that we needed to make sure that badge creation can't be spoofed easily. I need to mention some caveats, and make sure I am not misleading anyone. i) I am not an expert in React or node Great! Thanks, Abi. |
|
Yay, thanks @wjrsimpson -- we should maybe add these tests to our test suite. I'll make an issue. |
Update fetch to pass cookie to server
Change made from discussion with @wjrsimpson & @rcpeters on project call. Looks like we just needed to update some config to get the cookie passed!