File Security Permissions for NotAuthenticatedUser

General
1

Hello,

I’m having an issue figuring out security permissions - I’m trying to restrict certain file paths so that they cannot be accessed by not authenticated users. I have a folder restricted as below:

image
image1690×312 23 KB

image
image1670×76 4.97 KB

However, when I try to call this files on page loading they are restricted, even though the user is logged in and should be able to call these files.

image

Why is the server blocked the call when the user is Authenticated and should be able to access?

Thank you

2

Hi @G1299,

What response does the server return to a request to read a file?

Regards,
Marina

3

Hi Marina, it responds with a status 400 (Bad Request).

image
image2586×342 23.4 KB

4

@G1299,

It seems to me that your issue is not in the permissions but in the route. What response do you have if you grant the permission?

Regards,
Marina

5

If I grant Read permission to NotAuthenticatedUser the file reads and everything loads correctly.

image
image1680×78 3.27 KB

Confused on why its routing through the NotAuthenticatedUser route instead of AuthenticatedUser when the console shows user type as Authenticated.

6

@G1299

Please provide us with your appId and steps on how we can reproduce the issue.

Regards,
Marina

7

AppID: B46B9599-0927-5212-FF01-2D3539543E00

After logging in under the “Marketplace” page is where the images are read.

8

Hello, @G1299. Thank you information.

We will check into this issue.

Regards, Nikita.

9

Great, thank you Nikita!

10

An additional note - I do have cookie-based authorization enabled as well.

In the console it does not appear that the authorization cookie is getting generated after logging in.

11

Hi @G1299

I have one more request for you. Please create a test user in your application so that we can try logging in with their credentials and reproduce the issue.

At the moment, our preliminary assumption is that there might be something wrong with the cookie setup. I haven’t been able to reproduce your issue in my own application.

Regards,
Viktor

13

Hello @G1299!

Apologies for the inconvenience.
I’ve created a ticket to investigate this issue.
We’ll keep you updated in this thread once the issue is resolved.

Regards,
Alexander

15

Great, thanks for looking into this Alexander.

16

Hi @G1299 ,

Problem in your case was caused by fact that in UI Builder settings you selected different domain for API calls and files retrieval. This led to situation when auth cookie which was obtained during login, was considered as 3rd-party cookie and was blocked by browser.
I have updated UI Builder settings in your app to use your custom domain in both cases and problem has gone after that.

image
image1231×397 46.2 KB

Could you please try and confirm that problem has gone from your side?

Regards, Andriy

17

Hi Andriy,

Yes, that appears to have fixed it! Thank you all very much for the help!