From 4d576d664408a77a3d7d49658525565881997c75 Mon Sep 17 00:00:00 2001 From: Randall Morey Date: Mon, 28 Sep 2020 11:41:04 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20=F0=9F=90=9B=20fixes=20critical=20bug=20?= =?UTF-8?q?in=20token=20validity=20check?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit where the auth header was not sent, resulting in authentication not spanning page reloads --- addons/auth/addon/authenticators/password.js | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/addons/auth/addon/authenticators/password.js b/addons/auth/addon/authenticators/password.js index eb383d6c8..814fffc22 100644 --- a/addons/auth/addon/authenticators/password.js +++ b/addons/auth/addon/authenticators/password.js @@ -46,8 +46,17 @@ export default class PasswordAuthenticator extends BaseAuthenticator { async restore(data) { if (!data) return reject(); const tokenID = data.id; + const token = data.token; const tokenValidationURL = this.buildTokenValidationEndpointURL(tokenID); - const response = await fetch(tokenValidationURL, { method: 'get' }); + const response = await fetch(tokenValidationURL, { + method: 'get', + headers: { + // TODO: this is temporary to get the call working, but generating + // the auth header originated in the application authenticator. + // It should probably be factored out into a method on the base. + 'Authorization': `Bearer ${token}` + } + }); // 401 and 404 responses mean the token is invalid, whereas other types of // error responses do not tell us about the validity of the token. switch (response.status) {