Bug 1041618

Summary: [RFE][swift]: Change tempauth to check X-Auth-Token in HTTP cookies in addition to headers
Product: Red Hat OpenStack Reporter: RHOS Integration <rhos-integ>
Component: RFEsAssignee: RHOS Maint <rhos-maint>
Status: CLOSED UPSTREAM QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: markmc, yeylon
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
URL: https://blueprints.launchpad.net/swift/+spec/x-auth-token-in-cookies
Whiteboard: upstream_milestone_none upstream_status_unknown upstream_definition_new
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-19 17:13:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description RHOS Integration 2013-12-12 18:17:21 UTC 
Cloned from launchpad blueprint https://blueprints.launchpad.net/swift/+spec/x-auth-token-in-cookies.

Description:

For Javascript/HTML based application it is not possible to send HTTP header for downloading file locally via clicking on a link. TempURL middleware requires exposure of a secret key, which is not desirable for Javascript/HTML application since source code is entirely on the client.

The proposed solution is to change tempauth to recognize "X-Auth-Token" cookie, which could be set by Javascript in the browser. Then it will be possible to download file from Swift by clicking a link.

Here is a patch for tempauth.py:

132c132
<         token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
---
>         token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN', Request(env).cookies.get('X-Auth-Token')))


Specification URL (additional information):

None