feat: added WIP apikey request guard #185
Conversation
Codecov Report
@@ Coverage Diff @@
## master #185 +/- ##
==========================================
+ Coverage 59.67% 59.86% +0.18%
==========================================
Files 42 42
Lines 4308 4313 +5
==========================================
+ Hits 2571 2582 +11
+ Misses 1737 1731 -6
Continue to review full report at Codecov.
|
| let keys: Vec<_> = request.headers().get("x-api-key").collect(); | ||
| match keys.len() { | ||
| 0 => Outcome::Failure((Status::BadRequest, ApiKeyError::Missing)), | ||
| 1 if apikey == keys[0] => Outcome::Success(ApiKey(Some(keys[0].to_string()))), |
There was a problem hiding this comment.
That's a very convoluted way of expressing it.
Better to just have a single case for one and have the of statement inside a block.
There was a problem hiding this comment.
Sure, just picked it straight from the example.
|
@johan-bjareholt I've explained the reasoning for why it's needed in the docstring for But yes, the key will be exposed if not used with HTTPS. However, for Android apps it's still an improvement (since I assume they can't snoop on local packets however they like). |
Aha, that makes sense. |
ErikBjare
force-pushed
the
dev/apikey
branch
from
fd677a4 to
da279fa
Compare
ErikBjare
force-pushed
the
master
branch
2 times, most recently
from
9d93857 to
096da6d
Compare
No description provided.