Provide ACL token on client requests #3416
Conversation
|
|
||
| secret: computed.reads('token.secret'), | ||
|
|
||
| tokenIsValid: false, | ||
| tokenIsInvalid: false, | ||
| tokenRecord: null, | ||
|
|
||
| resetStore() { | ||
| this.get('store').unloadAll(); |
There was a problem hiding this comment.
dang that is a big 🔨 (but I get why it's necessary) - are models unique across tokens or is there also a risk of id collisions here?
There was a problem hiding this comment.
No risk of collisions. Also no risk of leaking anything the user didn't at least have prior access to. It's just a Do The Right Thing™ change. If the token doesn't give access then it shouldn't be shown.
DingoEatingFuzz
force-pushed
the
b-ui-provide-acl-token-on-client-requests
branch
from
d55f989 to
30806f9
Compare
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Rebased off of #3413This adds the
X-Nomad-Tokenheader to requests for allocation stats. However, adding a custom header to a cross-origin request invokes an OPTIONS preflight, which Nomad doesn't handle until #3414 merges.