API responses do not include any information about the currently authenticated user
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 109
- Forks
- 107
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 4
Description
Problem: When an auth token is expired on a front end app, there is currently no way to tell that the user needs to login again. Regular views that are not protected (e.g. portal root, any public content object) will always return HTTP 200 (with no content at all or just the content anonymous users are allowed to see). The only thing the front end app currently can do is accessing a protected resource and check the HTTP response (which is way to complex and time consuming to do on every single request).
A possible solution would be to include the authenticated user id (or "anonymous" in all responses). Maybe there are better options...
Opinions? @bloodbare @sneridagh @buchi @lukasgraf
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by tracing how authenticated and anonymous requests are represented in the REST API and review the existing comment discussion for a settled direction; done requires an agreed response contract and coverage for authenticated and anonymous cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100