From 1cbab91f6d5c4f02d5f5742dfa2fd6cb10246925 Mon Sep 17 00:00:00 2001 From: Joe Porpeglia Date: Fri, 22 Apr 2022 15:29:56 -0400 Subject: [PATCH] Add note on cookie-based authentication Signed-off-by: Joe Porpeglia --- docs/permission/getting-started.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/permission/getting-started.md b/docs/permission/getting-started.md index 0d87393b26..b115b674d6 100644 --- a/docs/permission/getting-started.md +++ b/docs/permission/getting-started.md @@ -34,6 +34,10 @@ Like many other parts of Backstage, the permissions framework relies on informat [The IdentityResolver docs](../auth/identity-resolver.md) describe the process for resolving group membership on sign in. +## Optionally add cookie-based authentication + +Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. + ## Integrating the permission framework with your Backstage instance ### 1. Set up the permission backend