Skip to main content

API delegated authentication chain scope (1.7.0)

Sam Critchley
Sam Critchley
Co-Founder

A security improvement to privileged authentication in the Spaaza API, for privileged clients that act on behalf of an end-user with the X-Spaaza-On-Behalf-Of header.

  • Fixed the checks made when a privileged client acts on behalf of an end-user with the X-Spaaza-On-Behalf-Of header. The access token must now be scoped to the chain to which that end-user belongs; a request for an end-user in a different chain, or for an end-user that cannot be matched to a chain, is rejected with access_denied (code 424). Previously the end-user was not checked against the chain scope of the access token. See acting on behalf of an end-user.
  • Changed the handling of the X-Spaaza-On-Behalf-Of header so that it is only accepted by the endpoints that support it, currently lock-voucher and delete-voucher. A privileged request that sends the header to any other endpoint is now rejected with access_denied (code 424) instead of being processed as an ordinary privileged request with the header ignored. API clients that send the header to other endpoints should remove it from those requests. This change is not tied to an API version.