removed ALLOW_ANY_API_KEY and allow skipping API key check in debug - #61
Conversation
| if api_key is not None: | ||
| if settings.ALLOW_ANY_API_KEY: | ||
| if api_key is not None or settings.DEBUG_SKIP_API_KEY_CHECK: | ||
| if settings.DEBUG_SKIP_API_KEY_CHECK: |
There was a problem hiding this comment.
The settings.DEBUG_SKIP_API_KEY_CHECK: was put below the api_key is not None check to give the dev a way to see the auth-failure case when no api-key was sent with the request. I personally think it is valuable to able to 'test' this case - even though it requires you to send a random api key. But that is debatable of course.
We might move the whole if settings.DEBUG_SKIP_API_KEY_CHECK: block above the if api_key check to simplify things.
There was a problem hiding this comment.
good point. I've re-introduced it, so there are now both variables to handle both cases. I've put the ALLOW_ANY into the ansible playbook so that against the dev machine, at least the presence of API keys is validated, but in local development, I've activated the complete skip.
andreaskoepf
left a comment
andreaskoepf
left a comment
There was a problem hiding this comment.
ok, we probably need to document the settings at a later point (e.g. with some doc-strings, since with the two options there will be now more questions than before ;-)) but otherwise lgtm.
…op-on-the-backend-api removed ALLOW_ANY_API_KEY and allow skipping API key check in debug
2 participants
the new environment variable is called DEBUG_SKIP_API_KEY_CHECK