MarigWeizhi commented on PR #11113: URL: https://github.com/apache/gravitino/pull/11113#issuecomment-4598239653
I have a question about the authorization flow of Lance REST Server. Previously, Lance REST Server called Gravitino through HTTP, so it could reuse Gravitino’s existing authorization interception logic to check what the user is allowed to do. After switching to the internal API/dispatcher path, this HTTP-layer authorization logic seems to be bypassed. Do we have a plan for enforcing authorization in Lance REST Server under this mode? Should we follow an approach similar to IRC, such as adding Lance-specific @AuthorizationExpression annotations and an authorization interception service for Lance REST endpoints? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
