Module: Warden::JWTAuth::EnvHelper

Defined in:
decidim-api/lib/warden/jwt_auth/decidim_overrides.rb

Overview

This module adds some overrides to Warde::JWTAuth due to some issues with how it needs to be setup.

Class Method Summary collapse

Class Method Details

.path_info(env) ⇒ String

Returns ORIGINAL_FULLPATH, REQUEST_PATH or REQUEST_URI environment variable, which is different from the original version returning the PATH_INFO environment variable.

This is overridden because the ‘PATH_INFO` string only includes the route under the engine where it is defined, i.e. `/sign_in` and `/sign_out` which are defined under the `Decidim::Api`.

Instead, we want this method to return the full path, i.e. ‘/api/sign_in` and `/api/sign_out` in order to map these routes correctly as the JWT token dispatch and revocation routes. Otherwise the token would be dispatched and revoked also with normal user sign in and sign out requests under the `Decidim::Core` engine which we do not want.

This affects the Devise::JWT / Warden::JWTAuth configuration that is defined at ‘decidim-api/config/initializers/devise.rb` (as `config.jwt`).

The return value is only used by Warden::JWTAuth to check when the token should be dispatched or revoked for the user, nothing else.

Note that this behaves slightly differently during controller testing and when the application is actually running under Rack. The end result is the same but some of the environment variables may be missing during controller testing (e.g. ‘REQUEST_PATH` is not defined under that situation).

Parameters:

  • env (Hash) —

    Rack env

Returns:

  • (String) 


37
38
39
 
# File 'decidim-api/lib/warden/jwt_auth/decidim_overrides.rb', line 37

def self.path_info(env)
  env["ORIGINAL_FULLPATH"] || env["REQUEST_PATH"] || env["REQUEST_URI"] || ""
end