Always include anonymous and authenticated roles when logged in about static-web-apps-cli HOT 10 CLOSED

No we are not adding a client principal header when a user is not logged in cause there is no client principal to add to the header.

from static-web-apps-cli.

If I get the documentation right, the anonymous role should apply to all unauthenticated users (even without login) and as soon as logged in, the roles should include authenticated but not anonymous anymore, correct @anthonychu ?

from static-web-apps-cli.

I think that's actually incorrect. If you hit the /.auth/me endpoint or read functions the client principal header when not logged in, they are null/empty. I'm unsure what happens if you use the anonymous role in routes authorization rules. @mkarmark can help confirm behavior.

from static-web-apps-cli.

When determining if a user is authorized to access a route, the behavior is what @itpropro describes. @anthonychu, is the concern that /.auth/me shows null/empty without logging in? That's because there isn't a user principal to display.

from static-web-apps-cli.

@anthonychu @mkarmark I understand that when a user is logged in, we should append the authenticated role to the user principal's userRoles array, like so:

{
  "identityProvider": "facebook",
  "userId": "d75b260a64504067bfc5b2905e3b8182",
  "userDetails": "[email protected]",
  "userRoles": ["authenticated" ]
}

However, where should we propagate the anonymous role if the user isn't logged in? Since the user principal is null.

from static-web-apps-cli.

I also asked myself, how this would work with anonymous @manekinekko. I was talking about this part from the documentation:

Every user who accesses a static web app belongs to one or more roles. There are two built-in roles that users can belong to:

anonymous: All users automatically belong to the anonymous role.
authenticated: All users who are logged in belong to the authenticated role.

This implicitly states that if a user is not logged in, he still holds the anonymous role. Is this just unclear documentation or is the proxy actually adding a clientPrincipal object to the header with the anonymous role that is not exposed to the /.auth/me endpoint @mkarmark ?

from static-web-apps-cli.

Thank you @mkarmark for confirming that.

from static-web-apps-cli.

Adding @craigshoemaker who wrote that documentation. Craig, could you provide more details about the anonymous role from this part of the docs?

anonymous: All users automatically belong to the anonymous role.
authenticated: All users who are logged in belong to the authenticated role.

from static-web-apps-cli.

@manekinekko Just tried this and it looks like logged in users are in authenticated role but not anonymous. Can we add anonymous too?

from static-web-apps-cli.

Added in 39f5dfb

from static-web-apps-cli.