Open Closed

Unauthenticated users were able to retrieve the contents of the tenants and paged tenants. #6301


User avatar
0
Yaduraj.Shakti created

Unauthenticated users were able to retrieve the contents of the tenants and paged tenants. https://myhost/api/saas/tenants

How to Secure this in our application?

  • ABP Framework version: v7.2.2
  • UI Type: Angularr
  • Database System: EF Core (PostgreSQL)
  • Tiered (for MVC) or Auth Server Separated (for Angular): yes/no
  • Exception message and full stack trace:
  • Steps to reproduce the issue: This behaviour can be seen in demo application as well https://commercial-demo.abp.io/api/saas/tenants

7 Answer(s)
  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    I could not reproduce the problem.

    If the user does not log in, it will redirect to login page

    If the user does not have permission, it will be rejected

  • User Avatar
    0
    Yaduraj.Shakti created

    Thanks for the quick response.

    Please can you guide where we might be missing Authorisation? Do we need to override this API in our application and how to do it with less impact on overall functionality?

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Hi,

    It already requires authorization, you don't need to override it

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    If you still face this problem, you can share a test project. I will check it. my email is shiwei.liang@volosoft.com

  • User Avatar
    0
    Yaduraj.Shakti created

    Hi @liangshiwei

    We have created a CustomTenantAppService

    public class CustomTenantAppService : ApplicationService, ITenantAppService { //Some code here to return tenant related data }

    DO we need to apply same [Authorize(SaasHostPermissions.Tenants.Default] in this class?

  • User Avatar
    0
    liangshiwei created
    Support Team Fullstack Developer

    Yes, you need it.

    If you inherit from TenantAppService, then you don't need it.

  • User Avatar
    0
    Yaduraj.Shakti created

    Great, Thank you so much for the quick help.

Made with ❤️ on ABP v9.1.0-preview. Updated on December 10, 2024, 06:38