Replace basic authentication with credentials authentication provider #3136
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apedroferreira
added
docs
github-actions
bot
added
the
PR: out-of-date
apedroferreira
force-pushed
the
in-app-basic-auth
branch
from
f12f71d
to
eecfa72
Compare
github-actions
bot
removed
the
PR: out-of-date
apedroferreira
force-pushed
the
in-app-basic-auth
branch
from
eecfa72
to
f12f71d
Compare
github-actions
bot
added
the
PR: out-of-date
apedroferreira
force-pushed
the
in-app-basic-auth
branch
from
f12f71d
to
045ba91
Compare
github-actions
bot
removed
the
PR: out-of-date
github-actions
bot
added
the
PR: out-of-date
|
As per last grooming meeting:
|
github-actions
bot
removed
the
PR: out-of-date
Looks like that even if I whitelist requests from iframes, which are all being blocked by the auth middleware right now, the CSRF protection doesn't allow the sign-in to work from a different domain. Maybe I could get around it by removing the same-site headers in the cookies Auth.js sets but that's less secure... |
github-actions
bot
added
the
PR: out-of-date
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We don't have to merge this one as not sure if it's a good idea and apparently the current basic authentication works well on iframes but this one might not work as well? Anyway the idea is here, if we close it it's ok.
We also don't necessarily have to remove the previous basic authentication, these features could coexist...
As has been briefly discussed before, here's how we could replace our current basic authentication feature with using the new authentication features, with a "Credentials" authentication provider that I already had to set up for authentication tests anyway.
Screen.Recording.2024-01-26.at.12.33.27.mov