alphagov/gds-sso — pull request #3 by jamiecobbett (2012-06-29 10:36:13+00:00)
Title: Skip authorisation for API users

FAO @jystewart

IMPORTANT: Note that the way this is implemented introduces a security vulnerability.
If you are authenticated in an app (i.e. you have the session cookie), you might craft
a request that sets the header that is used to determine whether or not this is an API
requst. You would then effectively be granted all permissions. If there is a way to
determine which strategy was used to authenticate, this vulnerability could be removed.

This code should not be very long-lived. Currently API users are authenticated with
basic auth, so there isn't a way to grant or read permissions for them. We plan to
switch API access to OAuth soon, at which point we can remove this.