geoadmin/mf-chsdi3 — pull request #1042 by procrastinatio (2014-10-02 09:38:53+00:00)
Title: [WIP] view decorator to check authorization

Alternative approach for [C2C #188450].

Instead of defining every ressources to *protect* on the varnish side, we may only let varnish set a custom header `X-Searchserver-Authorized`to `true`or `false` and protect the view ( `height`, `profile.json|csv` and ogcproxy) by a custom decorator.

Compare:

$ curl -I "http://localhost:9001/rest/services/height?easting=600000&northing=200000"
HTTP/1.1 403 Forbidden
Content-Length: 193
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Oct 2014 09:29:34 GMT
Server: waitress

with:

$ curl -I -X "X-Searchserver-Authorized: true" "http://localhost:9001/rest/services/height?easting=600000&northing=200000"
HTTP/1.0 200 OK
Connection: close
Content-Length: 16880
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Oct 2014 09:30:26 GMT
Last-Modified: Tue, 30 Sep 2014 10:07:44 GMT
Server: waitress

And:

$ curl -I -X "X-Searchserver-Authorized: false" "http://localhost:9001/rest/services/height? easting=600000&northing=200000"
HTTP/1.0 200 OK
Connection: close
Content-Length: 16880
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Oct 2014 09:30:40 GMT
Last-Modified: Tue, 30 Sep 2014 10:07:44 GMT
Server: waitress

See also