Comments (4)
Are you able to provide any information on this. At present it's unusable if it's not possible to grant public/anonymous users access to certain things.
from sails-permissions.
OK I've realised what's happening now. The sessionAuth policy is requiring the user to be logged in so no matter what permissions are set up they must be logged in first. This can be fixed by allowing access to actions through policies.js but this seems to defeat some of the purpose of this system.
Not sure if this would work, but I've seen this method used elsewhere, is users that are not logged would be assigned to a default anonymous user account, which would have a role of public only. I believe this would then make it possible to use the public role to grant access for anon users.
I think all that would be required is to include a default anon user account along with the default admin one and then changing the sessionAuth policy so that rather returning a 403 it assigns them as the anon user.
// api/policies/sessionAuth.js
module.exports = function(req, res, next) {
if (req.session.authenticated) {
return next();
} else {
User.findOne({username: 'anon'}).then(function(user){
req.user = user;
return next();
});
}
};
Obviously I can implement this myself but as there is a default public role it probably should be included. Also I'm not 100% sure if this method will cause any undesirable issues.
from sails-permissions.
from sails-permissions.
Ran into the same problem. I thought all visitors will be treated as public user. Also your workaround looks ok but it wont help in debug. As the requestlog will show all the public users as anon and it will be impossible to track down a particular request. There should be a method of creating a separate request id for each request and assign that as username with public role.
Any input from developers!
from sails-permissions.
Related Issues (20)
- langa.ioβs server DNS address could not be found.
- RolePolicy Cannot set property 'owner' of undefined HOT 6
- Broken limit, skip and populate find blueprint HOT 1
- Unable to signup unless logged in with Admin account HOT 4
- JWT Support? HOT 13
- Installation HOT 2
- Examples source coded needs to be added HOT 1
- Transfer sails npm user to sails.
- Project Status HOT 3
- read permissions blacklist not working HOT 1
- "Remember Me" functionality HOT 2
- PermissionService relation owner fatal error
- ReferenceError: sails is not defined HOT 2
- Mysql DB connection error HOT 1
- populate()- populating tables permission issue
- Error with Model Name is Account HOT 1
- PermissionService Error HOT 1
- PermissionService.findTargetObjects returns all objects
- Ownership access control for action 'read' not works and package still active?
- TODO remove enum and support permissions based on all controller
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sails-permissions.