diff --git a/src/modules/http-client/implementation/middleware/authentication-middleware.js b/src/modules/http-client/implementation/middleware/authentication-middleware.js index 87bdf99454..bb3ce98246 100644 --- a/src/modules/http-client/implementation/middleware/authentication-middleware.js +++ b/src/modules/http-client/implementation/middleware/authentication-middleware.js @@ -14,7 +14,11 @@ const parseIp = (req) => { }; export default (authService) => async (req, res, next) => { - const operation = req.url.split('/')[1].split('?')[0].toUpperCase(); + // eslint-disable-next-line no-useless-escape + const match = req.path.match(/^\/(?:v[0-9]+\/)?([^\/\?]+)/); + if (!match) return res.status(404).send('Not found.'); + + const operation = match[0].substring(1); if (authService.isPublicOperation(operation)) { return next(); diff --git a/src/modules/http-client/implementation/middleware/authorization-middleware.js b/src/modules/http-client/implementation/middleware/authorization-middleware.js index 3c9c03ca58..5c92020f15 100644 --- a/src/modules/http-client/implementation/middleware/authorization-middleware.js +++ b/src/modules/http-client/implementation/middleware/authorization-middleware.js @@ -5,7 +5,11 @@ const getToken = (req) => { }; export default (authService) => async (req, res, next) => { - const operation = req.url.split('/')[1].split('?')[0].toUpperCase(); + // eslint-disable-next-line no-useless-escape + const match = req.path.match(/^\/(?:v[0-9]+\/)?([^\/\?]+)/); + if (!match) return res.status(404).send('Not found.'); + + const operation = match[0].substring(1); if (authService.isPublicOperation(operation)) { return next(); diff --git a/src/service/auth-service.js b/src/service/auth-service.js index 729923934c..49a0a65ee1 100644 --- a/src/service/auth-service.js +++ b/src/service/auth-service.js @@ -62,7 +62,10 @@ class AuthService { return false; } - return this._authConfig.publicOperations.includes(operationName); + return ( + this._authConfig.publicOperations.includes(`v0/${operationName}`) || + this._authConfig.publicOperations.includes(operationName) + ); } /** diff --git a/test/unit/middleware/authentication-middleware.test.js b/test/unit/middleware/authentication-middleware.test.js index cd67d9b888..287af08f03 100644 --- a/test/unit/middleware/authentication-middleware.test.js +++ b/test/unit/middleware/authentication-middleware.test.js @@ -25,7 +25,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend })); @@ -46,7 +46,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend })); @@ -67,7 +67,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend })); diff --git a/test/unit/middleware/authorization-middleware.test.js b/test/unit/middleware/authorization-middleware.test.js index 6d254394f8..6e0dd30714 100644 --- a/test/unit/middleware/authorization-middleware.test.js +++ b/test/unit/middleware/authorization-middleware.test.js @@ -26,7 +26,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend })); @@ -46,7 +46,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend })); @@ -67,7 +67,7 @@ describe('authentication middleware test', async () => { }), ); - const req = { headers: { authorization: 'Bearer token' }, url: '/publish' }; + const req = { headers: { authorization: 'Bearer token' }, path: '/publish' }; const spySend = sandbox.spy(); const spyStatus = sandbox.spy(() => ({ send: spySend }));