You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Rails.application.auth0_api_client acts as if it was the latter. This is potentially a security issue, on top of not allowing us to manage users and provide a link to impersonate. At the root of this issue is that V2 JWT token does not work with impersonation API, which should be in V2 afterall.
The text was updated successfully, but these errors were encountered:
The issue stems from using HTTParty class method headers. The headers should have been isolated to an instance variable and added in perform_request.
I have a VERY hacky workaround, but it works. Since the headers are set at class level, it's easy to create 2 subclasses of the Auth0Client and use them to create instances.
Apparently header information is being clobbered between 2 separate instances of clients.
I need V2 client for user management, and V1 client to generate impersonation links.
When I have this:
Rails.application.auth0_api_client
acts as if it was the latter. This is potentially a security issue, on top of not allowing us to manage users and provide a link to impersonate. At the root of this issue is that V2 JWT token does not work with impersonation API, which should be in V2 afterall.The text was updated successfully, but these errors were encountered: