Github user kxepal commented on the pull request:
https://github.com/apache/couchdb/pull/366#issuecomment-159752272
@janl
1. CSRF protection by requiring application/json Content-Type in request
2. Tests are looks too much commented (:
3. Admin Party TODO
+ I though about differences between your and Cloudant version...I think
it's possible to have both behaviours:
- When you require all users to be created in CouchDB with proper roles
(yours version)
- When you can use generic users with custom roles ala Proxy Auth (Cloudant
version)
I think both could be useful depending on the use case and that behaviour
could be controlled by some config option. How do you feel with it?
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
