class DenyTestAuthRequests

Cache policy for pages requested with REST Test Auth.

This policy disallows caching of requests that use the REST Test Auth authentication provider for security reasons (just like basic_auth). Otherwise responses for authenticated requests can get into the page cache and could be delivered to unprivileged users.

Hierarchy

• class \Drupal\rest_test\PageCache\RequestPolicy\DenyTestAuthRequests implements \Drupal\Core\PageCache\RequestPolicyInterface

Expanded class hierarchy of DenyTestAuthRequests

See also

\Drupal\rest_test\Authentication\Provider\TestAuth

\Drupal\rest_test\Authentication\Provider\TestAuthGlobal

\Drupal\basic_auth\PageCache\DisallowBasicAuthRequests

File

core/modules/rest/tests/modules/rest_test/src/PageCache/RequestPolicy/DenyTestAuthRequests.php, line 20

Namespace

class DenyTestAuthRequests implements RequestPolicyInterface {
  
  /**
   * {@inheritdoc}
   */
  public function check(Request $request) {
    if ($request->headers
      ->has('REST-test-auth') || $request->headers
      ->has('REST-test-auth-global')) {
      return self::DENY;
    }
  }

}

Members