Tenancy Token - Placeholder Search Privacy Issue about meilisearch HOT 5 CLOSED

Hello @akilic942

thanks for your feedback, really precious! I will transfer to the Cloud team.

from meilisearch.

Hi @akilic942 the bug was fixed!

I even updated our demo (https://tenant-token.meilisearch.com) to use the edge, so you can see it working ;)

Thanks a lot for the hint about the bug!

from meilisearch.

Hey @akilic942 👋

I just tried using cURL, and it works perfectly when I use the tenant token generated with this online JSON Webtoken generator. I used the default movies dataset you can find on the getting started page of the documentation and added a filter to only display the Matrix movie (id = 603).

Would it be possible to tell me more about the way you configured your JS client? Or give me a reproducer with cURL requests, please?

Have a nice day 🌔

from meilisearch.

@akilic942 It sounds like you have a searchtoken or apikey configured as default (in the JS SDK) and it's being used until the users token kicks in. We are using this type of setup and we make sure to fetch the users token before any search is made, if the users token isn't able to be fetched the whole search will just fail with unauthorized as it should.

This is easily achieved by using a custom httpclient or if you already have the token custom request config
https://github.com/meilisearch/meilisearch-js?tab=readme-ov-file#custom-request-config-
https://github.com/meilisearch/meilisearch-js?tab=readme-ov-file#custom-http-client-

from meilisearch.

Thank you for you replies @Kerollmops @Fronix

I just tried using cURL, and it works perfectly when I use the tenant token generated

I tried it myself, i get the same results as I stated in my first response. The first place holder search gives me the results of the last placeholder search. The second place holder search finally uses the right filters.

Would it be possible to tell me more about the way you configured your JS client? Or give me a reproducer with cURL requests, please?

curl --location 'https://edge.meilisearch.com/indexes/Customers/search' \ --header 'Authorization: Bearer XXXXXX' \ --data ''

While i was typing this, i changed https://edge.meilisearch.com (Analytics and monitoring) to the original meilisearch-cloud url - and voila, that fixed it.

It seems to be a bug with edge.meilisearch.com Analytics and monitoring URL

from meilisearch.