From 1203493c97926f69e2b7c79ac8f456b400b850fe Mon Sep 17 00:00:00 2001 From: hillmandj Date: Tue, 25 Oct 2022 11:02:55 -0400 Subject: [PATCH] Additional Authenticate API Doc Updates Signed-off-by: hillmandj --- contrib/docs/tutorials/authenticate-api-requests.md | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/contrib/docs/tutorials/authenticate-api-requests.md b/contrib/docs/tutorials/authenticate-api-requests.md index c8f4083a0c..45f0c3302f 100644 --- a/contrib/docs/tutorials/authenticate-api-requests.md +++ b/contrib/docs/tutorials/authenticate-api-requests.md @@ -4,7 +4,7 @@ The Backstage backend APIs are by default available without authentication. To a API requests from frontend plugins include an authorization header with a Backstage identity token acquired when the user logs in. By adding a middleware that verifies said token to be valid and signed by Backstage, non-authenticated requests can be blocked with a 401 Unauthorized response. -**NOTE**: Enabling this means that Backstage will stop working for guests, as no token is issued for them. +**NOTE**: Enabling this means that Backstage will stop working for guests, as no token is issued for them. If you have not done so already, you will also need to implement [service-to-service auth](https://backstage.io/docs/auth/service-to-service-auth). As techdocs HTML pages load assets without an Authorization header the code below also sets a token cookie when the user logs in (and when the token is about to expire). @@ -61,7 +61,7 @@ export const createAuthMiddleware = async ( try { const token = getBearerTokenFromAuthorizationHeader(req.headers.authorization) || - (req.cookies.token as string | undefined); + (req.cookies?.token as string | undefined); if (!token) { res.status(401).send('Unauthorized'); return; @@ -180,7 +180,12 @@ export async function setTokenCookie(url: string, identityApi: IdentityApi) { ``` ```typescript -// packages/app/src/App.tsx from a create-app deployment +// required types and packages for example below + +import type { IdentityApi } from '@backstage/core-plugin-api'; +import { discoveryApiRef, useApi } from '@backstage/core-plugin-api'; + +// additional packages/app/src/App.tsx from a create-app deployment import { setTokenCookie } from './cookieAuth';