[
https://issues.apache.org/jira/browse/UNOMI-1013?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Serge Huber updated UNOMI-1013:
-------------------------------
Fix Version/s: unomi-4.0.0
(was: unomi-4.1.0)
> Let each tenant list the websites that can use its tracker
> ----------------------------------------------------------
>
> Key: UNOMI-1013
> URL: https://issues.apache.org/jira/browse/UNOMI-1013
> Project: Apache Unomi
> Issue Type: Improvement
> Reporter: Serge Huber
> Priority: Major
> Fix For: unomi-4.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h3. Summary
> With UNOMI-1005, the operator of a Unomi server can list the website origins
> whose pages may send cookies to Unomi. This list is the same for every
> tenant. In a server with many tenants, each tenant has its own websites, and
> the operator has to manage all of them in one place.
> The goal of this ticket is to let each tenant manage its own list, while the
> default stays secure.
> h3. Ways to explore
> * A list of origins in the tenant settings, managed through the tenant API,
> with the same exact matching rules as the operator list.
> * The browser's preflight request does not carry the API key value, so the
> server cannot know the tenant at that point. The preflight could accept an
> origin listed by the operator or by any tenant. The real request, which
> carries the key, is then checked on the server against that tenant's own
> list, and its visitor cookie is not used if the origin is not allowed for
> that tenant.
> * A setting lets the operator turn tenant lists off. Tenant lists can only
> add origins for that tenant; they never change the operator rules.
> * Document how the operator and tenant lists work together.
> h3. How to test
> Automated tests to add:
> * An origin listed by tenant A works with tenant A's key.
> * The same origin with tenant B's key is not tied to the visitor's profile.
> * With tenant lists turned off, only the operator list counts.
> * Origins listed by a tenant follow the same matching rules as the operator
> list.
> * All the tests from UNOMI-1005 still pass.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
