check for api/catalog calls, dont add base path for them #3

jgfidelis · 2019-05-20T20:05:38Z

https://fidelis2--invictastores.myvtex.com

drawveloper · 2019-05-21T11:59:48Z

node/handlers/catalog.ts

@@ -32,6 +33,7 @@ export const catalog = async (ctx: Context) => {
      'Authorization': authToken,
      'Proxy-Authorization': authToken,
      'User-Agent': process.env.VTEX_APP_ID,
+      VtexIdclientAutCookie: authToken,


Wow! That's not safe at all - you're adding this app's token to communicate with an API, yet we have no idea what permissions the actual caller had. Why did you have to send this header? This might effectively make a private API public, through this proxy, if this app has sufficient permissions.

check for api/catalog calls, dont add base path for them

eda0276

drawveloper suggested changes May 21, 2019

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

check for api/catalog calls, dont add base path for them #3

check for api/catalog calls, dont add base path for them #3

jgfidelis commented May 20, 2019 •

edited

Loading

drawveloper May 21, 2019

check for api/catalog calls, dont add base path for them #3

Are you sure you want to change the base?

check for api/catalog calls, dont add base path for them #3

Conversation

jgfidelis commented May 20, 2019 • edited Loading

drawveloper May 21, 2019

Choose a reason for hiding this comment

jgfidelis commented May 20, 2019 •

edited

Loading