Serge Huber created UNOMI-1013:
----------------------------------
Summary: Let each tenant list the websites that can use its tracker
Key: UNOMI-1013
URL: https://issues.apache.org/jira/browse/UNOMI-1013
Project: Apache Unomi
Issue Type: Improvement
Reporter: Serge Huber
Fix For: unomi-4.1.0
h3. Summary
With UNOMI-1005, the operator of a Unomi server can list the website origins
whose pages may send cookies to Unomi. This list is the same for every tenant.
In a server with many tenants, each tenant has its own websites, and the
operator has to manage all of them in one place.
The goal of this ticket is to let each tenant manage its own list, while the
default stays secure.
h3. Ways to explore
* A list of origins in the tenant settings, managed through the tenant API,
with the same exact matching rules as the operator list.
* The browser's preflight request does not carry the API key value, so the
server cannot know the tenant at that point. The preflight could accept an
origin listed by the operator or by any tenant. The real request, which carries
the key, is then checked on the server against that tenant's own list, and its
visitor cookie is not used if the origin is not allowed for that tenant.
* A setting lets the operator turn tenant lists off. Tenant lists can only add
origins for that tenant; they never change the operator rules.
* Document how the operator and tenant lists work together.
h3. How to test
Automated tests to add:
* An origin listed by tenant A works with tenant A's key.
* The same origin with tenant B's key is not tied to the visitor's profile.
* With tenant lists turned off, only the operator list counts.
* Origins listed by a tenant follow the same matching rules as the operator
list.
* All the tests from UNOMI-1005 still pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
