api-platform / api-platform/core

Make hydra documentation respect access control

Open
#2,719 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
2.6k
Forks
980
Avg merge
2d 5h
Merged PRs (30d)
48

Description

My api has public and private entries.

But the hydra and swagger documentations expose all of them.

As a result, a connected user that has access to only parts of the api will see the whole documentation which is not a good thing for security.

More importantly, the admin is broken in that case because it tries to fetch every resource in the hydra documentation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.