dataiku / dataiku/dss-plugin-api-connect
Redirect Causes a Lost Authorization Header
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 4
- Forks
- 4
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 1
Description
The API we're consuming has a base URL we initially hit but are then redirected to version-specific URL where the API request is ultimately made. If we use the base URL with the plugin, we're getting a 401 error, because the authorization header is not being passed to the redirected URL. This is similar to the StackOverflow article here: https://stackoverflow.com/questions/28564961/authorization-header-is-lost-on-redirect
Postman solves this by having a checkbox to explicitly allow this if the user requires. I'm assuming it is slightly less secure, so having it off by default may make sense here as well.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the 401 response when an API request follows a redirect from the base URL, and inspect the request flow that handles redirected URLs. Compare the behavior with the linked Stack Overflow example and Postman's explicit option; done means the authorization behavior is defined and the redirected request no longer unexpectedly fails.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100