Merged
Conversation
jpetto
force-pushed
the
HNT-2548-reject-requests-without-valid-jwt
branch
from
3e9be17 to
1b41ea8
Compare
mmiermans
reviewed
May 5, 2026
| Sentry.captureException('Request is missing JWT'); | ||
|
|
||
| // throw a generic error if request is missing JWT | ||
| throw new Error('Internal server error'); |
Contributor
There was a problem hiding this comment.
Should we throw a 401 instead of a generic error, to have accurate error statistics?
Collaborator
Author
There was a problem hiding this comment.
i waffled between telling a potential attacker they were unauthorized versus giving them no additional info and (obviously) landed on the latter. i'm good with it as-is for now. we'll get sentry counts for this scenario.
mmiermans
approved these changes
May 5, 2026
Contributor
mmiermans
left a comment
mmiermans
left a comment
There was a problem hiding this comment.
Approved with a minor suggestion
jpetto
force-pushed
the
HNT-2548-reject-requests-without-valid-jwt
branch
2 times, most recently
from
faed917 to
1b41ea8
Compare
- fix sentry import in jwtUtils (this was never working?) - add tests for getAppContext
jpetto
force-pushed
the
HNT-2548-reject-requests-without-valid-jwt
branch
from
1b41ea8 to
878b377
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
reject all requests to admin API that do not include a JWT to reduce potential attacks from the wider internet. (the admin API gateway is open to the public due to the curation admin tool.)
currently deployed to dev.
client testing checklist:
I'd love feedback/perspectives on:
Implementation Decisions:
there isn't too much actually changed here - instead of allowing a missing
tokenwhen creating the app context, we are now requiring it.even though in practice some of the fields are now required, i didn't update the
IContexttype to keep the changes here small in scope. i can update to do this if we think it's worthwhile.References
JIRA ticket: