fm-orchestrator

#330 [audit] Replace request.cookies usage with request.headers
Closed: Fixed Opened by ralph.

Closed: Fixed
Reopen Issue

We currently pass the oidc_token from the submit_build.py client to the server in a cookie. This doesn't make any sense (says @puiterwijk).

He advises that we instead pass it in an Authorization: Bearer $token header (or in form data... but let's use the header).

One issue with cookies is that improperly written clients would be sending the token on every single request (even those that don't need it), and might also sent it accidentally when getting sent over non-secure channels.

See #343.

Metadata Update from @ralph:
- Issue assigned to ralph

Commit 61b7b6f4 fixes this issue

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/mbs/issues/330

Please continue any further discussion there.
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.