WS-2449: Use cookie auth for UAS instead of Authorization header#13876
WS-2449: Use cookie auth for UAS instead of Authorization header#13876
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the UAS client authentication approach to rely on cookie-based auth rather than sending an Authorization bearer token header.
Changes:
- Removes reading
ckns_atknfromjs-cookieand stops constructingAuthorization/X-Authentication-Providerheaders. - Keeps
X-API-Keyheader generation and tightens the missing-config error to only cover the API key.
| if (!apiKey) { | ||
| throw new Error('Missing UAS public API key'); | ||
| } | ||
|
|
||
| const headers: Record<string, string> = { | ||
| Authorization: `Bearer ${cknsAtkn}`, | ||
| 'X-Authentication-Provider': 'idv5', | ||
| 'X-API-Key': apiKey, | ||
| }; |
There was a problem hiding this comment.
This change removes the Authorization / X-Authentication-Provider headers, but existing UAS request tests still assert those headers and also assert an error when the ckns_atkn cookie is missing. With cookie-based auth, these expectations should be updated (e.g. only assert X-API-Key, and remove/replace the cookie-missing error case) so CI reflects the new authentication mechanism.
| import onClient from '#app/lib/utilities/onClient'; | ||
| import { getEnvConfig } from '../utilities/getEnvConfig'; | ||
|
|
||
| const getAuthHeaders = (): Record<string, string> => { |
There was a problem hiding this comment.
The file is named getAuthHeader.ts but the exported function is getAuthHeaders. Consider renaming either the file or the function so singular/plural naming is consistent and easier to discover via imports/search.
| if (!cknsAtkn || !apiKey) { | ||
| throw new Error('Missing authentication for UAS request'); | ||
| if (!apiKey) { | ||
| throw new Error('Missing UAS public API key'); |
There was a problem hiding this comment.
The thrown error is fairly generic; including the env var name (SIMORGH_UAS_PUBLIC_API_KEY) in the message would make misconfiguration easier to diagnose from logs.
| throw new Error('Missing UAS public API key'); | |
| throw new Error( | |
| 'Missing required environment variable: SIMORGH_UAS_PUBLIC_API_KEY', | |
| ); |
Resolves JIRA: https://bbc.atlassian.net/browse/WS-2449
Summary
ckns_atknis attacked to the request) instead of authorization headerCode changes
Testing
Useful Links