mirror of
https://github.com/TryGhost/Ghost.git
synced 2024-11-28 22:43:30 +03:00
79959d9581
no issue - if you blog runs on a custom domain, but your admin panel is configured using a different domain -> Ghost losts the origin header - we had this situation once with pretty urls (your request get's redirected from /posts to /posts/, see https://github.com/TryGhost/Ghost/pull/8094) - we've moved all our redirect logic to Ghost and ran into the same situation - i've added proper test to ensure it won't happen again
53 lines
1.4 KiB
JavaScript
53 lines
1.4 KiB
JavaScript
var prettyURLs = require('../middleware/pretty-urls'),
|
|
cors = require('../middleware/api/cors'),
|
|
urlRedirects = require('../middleware/url-redirects'),
|
|
auth = require('../auth');
|
|
|
|
/**
|
|
* Auth Middleware Packages
|
|
*
|
|
* IMPORTANT
|
|
* - cors middleware MUST happen before pretty urls, because otherwise cors header can get lost on redirect
|
|
* - cors middleware MUST happen after authenticateClient, because authenticateClient reads the trusted domains
|
|
* - url redirects MUST happen after cors, otherwise cors header can get lost on redirect
|
|
*/
|
|
|
|
/**
|
|
* Authentication for public endpoints
|
|
*/
|
|
module.exports.authenticatePublic = [
|
|
auth.authenticate.authenticateClient,
|
|
auth.authenticate.authenticateUser,
|
|
// This is a labs-enabled middleware
|
|
auth.authorize.requiresAuthorizedUserPublicAPI,
|
|
cors,
|
|
urlRedirects,
|
|
prettyURLs
|
|
];
|
|
|
|
/**
|
|
* Authentication for private endpoints
|
|
*/
|
|
module.exports.authenticatePrivate = [
|
|
auth.authenticate.authenticateClient,
|
|
auth.authenticate.authenticateUser,
|
|
auth.authorize.requiresAuthorizedUser,
|
|
cors,
|
|
urlRedirects,
|
|
prettyURLs
|
|
];
|
|
|
|
/**
|
|
* Authentication for client endpoints
|
|
*/
|
|
module.exports.authenticateClient = function authenticateClient(client) {
|
|
return [
|
|
auth.authenticate.authenticateClient,
|
|
auth.authenticate.authenticateUser,
|
|
auth.authorize.requiresAuthorizedClient(client),
|
|
cors,
|
|
urlRedirects,
|
|
prettyURLs
|
|
];
|
|
};
|