Unable to reset API key of client as non-admin user
Open
bug
- Dominant language
- Java
- Stars
- 11
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
The "More Details" button under "Api key details" on the client page brings you to a 403 page and you are unable to reset the API key.
@GAsplund theorized that this could be because the `/api-keys` path is protected, since the admin clients are on the same path.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the client page's "More Details" link and the /api-keys path, then compare access control for admin and non-admin clients. Done means a non-admin can reset the client's API key without receiving a 403, with coverage for both permission cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100