Anonymous options are fine #21691
Anonymous options are fine #21691
Conversation
Signed-off-by: Roeland Jago Douma <[email protected]>
You now made it block more and not less. Before it returned an empty response for anonymous request coming from office only. Now it does this for all anonymous requests. 🤔 |
|
Yeah. But before I threw a 403 now at least you get something back. |
| $emptyAuth = $request->getHeader('Authorization') === null | ||
| || $request->getHeader('Authorization') === '' | ||
| || trim($request->getHeader('Authorization')) === 'Bearer'; | ||
| $isAnonymousOfficeOption = $request->getMethod() === 'OPTIONS' && $isOffice && $emptyAuth; |
There was a problem hiding this comment.
The reason we only handle anonymous options for Office were because this was breaking evolution and macOS sync when there was no 404 returned for those. See #20632
@rullzer Any more details on what this PR supposes to fix?
There was a problem hiding this comment.
Basically it is about becomming RFC compliant. OPTIONS request are usually unauthenticated and that is fine.
There was a problem hiding this comment.
Then we probably should just limit the options plugin to requests to the files app dav path?
There is no reason to block those anonymous options requests. Right now they don't return anything. But they could at some point of course 😉