From 61d4dc593e73d4fa10ed09c34a222bd180affd4f Mon Sep 17 00:00:00 2001 From: aramissennyeydd Date: Mon, 22 Apr 2024 10:40:03 -0400 Subject: [PATCH] whoops Signed-off-by: aramissennyeydd --- docs/plugins/backend-plugin.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/plugins/backend-plugin.md b/docs/plugins/backend-plugin.md index 9984112f96..46997f0101 100644 --- a/docs/plugins/backend-plugin.md +++ b/docs/plugins/backend-plugin.md @@ -227,7 +227,7 @@ database.. ## Making Use of the User's Identity -The Backstage backend also offers a core service to access the user's identity. You can access it through the `coreServices.identity` dependency. +The Backstage backend also offers a core service to access the user's identity. You can access it through the `coreServices.httpAuth` and `coreServices.userInfo` dependencies. ```ts title="plugins/carmen-backend/src/plugin.ts" deps: { @@ -272,6 +272,10 @@ export async function createRouter( const { userInfo, httpAuth } = options; router.post('/me', async (request, response) => { + if (!auth.isPrincipal(credentials, 'user')) { + // Block requests that aren't from the user, this can include services or external callers. + response.status(401); + } const credentials = await httpAuth.credentials(request) const userInfo = await userInfo.getUserInfo(credentials); response.json(