Search code examples
fiwarefiware-keyrock

DELETE request for organizations does not require auth token

I've noticed when you are about to delete an organization the suggested request in docu is this one (subsection DELETE AN ORGANIZATION inside ORGANIZATION CRUD ACTIONS):

curl -iX DELETE \
  'http://localhost:3005/v1/organizations/{{organization-id}}' \
  -H 'Content-Type: application/json' \

Which does not include the X-Auth-token as part of the header.

Could this result in a security issue (allowing anyone to delete any organization)?

Solution

  • The command for delete of organization in the referenced document is incomplete.

    curl -iX DELETE \
  'http://localhost:3005/v1/organizations/{{organization-id}}' \
  -H 'Content-Type: application/json' \

    the X-Auth-Token in the above mentioned command is missing, without X-Auth-Token one will not be able to delete the oraganization or perform any other operations.

    The command without X-Auth-Token will have the following response:

    {
    "error": {
        "message": "Expecting to find X-Auth-token in requests",
        "code": 400,
        "title": "Bad Request"
    }
}

    The correct command will have X-Auth-Token in its header:

    curl -iX DELETE \
      'http://localhost:3005/v1/organizations/{{organization-id}}' \
      -H 'Content-Type: application/json' \
      -H 'X-Auth-Token: {{X-Auth-Token}}

    the above command(with X-Auth-Token) will have response with Http Status HTTP/1.1 204 No Content

    Screenshot:
    response
    response