Skip default authorization strategy for custom paths

[mrbatista]

Suggestion

When set default authentication strategy the access to the rest explorer is forbidden.
This is particular situation when is not possible to use @authorization.skip() decorator.
My suggestions:

1. Add new property to rest explorer configuration to skip authorization strategy for path where rest explorer is mounted.

2. Add new property to AuthenticationStrategy configuration to specific list of path to skip. Like this

Use Cases

Examples

Acceptance criteria

TBD - will be filled by the team.

[dhmlau]

@emonddr, could you PTAL? Thanks.

[emonddr]

@mrbatista, thank you for your question.

I am trying to understand your suggestion.

The API Explorer url will show all the endpoints contributed by multiple controllers (ProductController, OrderController, PingController). The @authenticate decorator can be added to controller methods or a controller class. If it is specified at ProductController class level, then @authentication.skip() can be used at a controller method level to turn off authentication for that method only.

But it seems your are asking how to prevent access to the /explorer url itself so noone can access the API Explorer ..is this correct?

[emonddr]

In LoopBack 4, you can prevent the api explorer from appearing by following these instructions:
https://loopback.io/doc/en/lb4/Self-hosted-rest-api-explorer.html#disable-self-hosted-api-explorer

[mrbatista]

@emonddr I needs to allow access to api explorer for unauthenticated user.

In my application I configured the default authentication.
After this change the api explorer page is not accessible because the default path require a valid jwt token.
My question is: How can I disable authentication for api explorer path?

[derdeka]

@mrbatista If you want to whitelist the authorization for specific resources, you could use an voter for this:

import { AuthorizationContext, AuthorizationDecision, AuthorizationMetadata, Authorizer } from "@loopback/authorization";
import { config, Provider } from '@loopback/context';

export interface WhitelistAuthorizationProviderOptions {
  noAuthorizationResourcePattern?: RegExp[];
}

export class WhitelistAuthorizationProvider implements Provider<Authorizer> {

  constructor(
    @config() private options: WhitelistAuthorizationProviderOptions = {},
  ) { }

  value(): Authorizer {
    return this.authorize.bind(this);
  }

  async authorize(authorizationCtx: AuthorizationContext, metadata: AuthorizationMetadata): Promise<AuthorizationDecision> {
    // authorize access for whitelisted resources
    if (this.options?.noAuthorizationResourcePattern?.some(regexp => regexp.test(authorizationCtx.resource))) {
      return AuthorizationDecision.ALLOW;
    }
    // do not vote for this resource
    return AuthorizationDecision.ABSTAIN;
  }
}

For the explorer you just need the pattern /^ExplorerController\./ to vote for a AuthorizationDecision.ALLOW.

Does this solve your issue?

[mrbatista]

@derdeka No authorization is configurated. I need a way to specific that explorer path skip default authentication strategy. For example:

this.configure(RestExplorerBindings.COMPONENT).to({
  path: '/explorer',
  disableAuthentication: true
 });

[stale]

This issue has been marked stale because it has not seen activity within six months. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository. This issue will be closed within 30 days of being stale.

[stale]

This issue has been closed due to continued inactivity. Thank you for your understanding. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository.