chore/SRE-583 Deprecate usage of Auth-Email Header #1528
Conversation
bitwarden-charlie
requested review from
matt-livefront and
a team
as code owners
|
Great job, no security vulnerabilities found in this Pull Request |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1528 +/- ##
==========================================
+ Coverage 89.67% 89.69% +0.01%
==========================================
Files 766 777 +11
Lines 48109 48967 +858
==========================================
+ Hits 43141 43919 +778
- Misses 4968 5048 +80 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
| return [:] | ||
| } | ||
| return ["Auth-Email": Data(email.utf8).base64EncodedString().urlEncoded()] | ||
| // Auth-Email header is deprecated and no longer needed |
There was a problem hiding this comment.
Is this change live in any environment? I tested this in dev, QA, and prod but always get a 400 error from the /identity/connect/token endpoint when attempting to log in.
POST https://vault.usdev.bitwarden.pw/identity/connect/token 400
Response:
{
"error": "invalid_grant",
"error_description": "Auth-Email header invalid."
}
There was a problem hiding this comment.
🤔Additionally to what Matt commented, should this be behind a feature flag so we can better control when to disable the code? Not sure when this was deprecated on server, but there may be people using old self-host server versions and they will need the header to perform a good request.
🎟️ Tracking
https://bitwarden.atlassian.net/browse/SRE-583
📔 Objective
Deprecate usage of Auth-Email Header
📸 Screenshots
⏰ Reminders before review
🦮 Reviewer guidelines
:+1:) or similar for great changes:memo:) or ℹ️ (:information_source:) for notes or general info:question:) for questions:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion:art:) for suggestions / improvements:x:) or:warning:) for more significant problems or concerns needing attention:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt:pick:) for minor or nitpick changes