I started on working on BlueOcean REST API security related tickets: JENKINS-35783 <https://issues.jenkins-ci.org/browse/JENKINS-35783>, JENKINS-35766 <https://issues.jenkins-ci.org/browse/JENKINS-35766> and came up with this design document for your review, Please leave the comment.
Summary: BlueOcean APIs do not plan on using cookie to authenticate user. It’s going to use JWT tokens to serve the claim and verify the claim on each API calls. Further CORS is going to be used to check cross domain calls. Benefits of JWT: - Mitigate CSRF risk - Stateless authentication without central coordinated server - Allow frontend to access user properties just from a token, without making server calls - (more about this here <https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/> ) Here is the design document: https://docs.google.com/document/d/1LrsK4w-PRbQu8aBJXxoaFEvxRjlpIo1Z1k4Sr68ALuY/edit?usp=sharing thanks, vivek. -- You received this message because you are subscribed to the Google Groups "Jenkins Developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-dev/CAKT4V1_p2RRGSzjyKjws3HMiDVdb4iB%2BSb3nqrVo_okMQDGTZw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
