Backstage
    Preparing search index...

    Interface HttpAuthService

    Provides handling of credentials in an ongoing request.

    See the service documentation for more details.

    interface HttpAuthService {
        credentials<TAllowed extends keyof BackstagePrincipalTypes = "unknown">(
            req: Request<any, any, any, any, any>,
            options?: { allow?: TAllowed[]; allowLimitedAccess?: boolean },
        ): Promise<BackstageCredentials<BackstagePrincipalTypes[TAllowed]>>;
        issueUserCookie(
            res: Response,
            options?: { credentials?: BackstageCredentials },
        ): Promise<{ expiresAt: Date }>;
    }

    Implemented by

    Index

    Methods

    credentials issueUserCookie

    Methods

    • Extracts the caller's credentials from a request.

      Type Parameters

      Parameters

      • req: Request<any, any, any, any, any>

        An Express request object.

      • Optionaloptions: { allow?: TAllowed[]; allowLimitedAccess?: boolean }

        Optional further restrictions.

        • Optionalallow?: TAllowed[]

          If specified, allow only principals of the given type(s).

          If the incoming credentials were not of a type that matched this restriction, a @backstage/errors#NotAllowedError is thrown.

          The default is to allow user and service principals.

        • OptionalallowLimitedAccess?: boolean

          If set to true, allow limited access tokens (such as cookies).

          If this flag is not set, or is set to false, calls with limited access tokens will lead to a @backstage/errors#NotAllowedError being thrown.

      Returns Promise<BackstageCredentials<BackstagePrincipalTypes[TAllowed]>>

      The credentials have been validated before returning, and are guaranteed to adhere to whatever policies have been added to this route using HttpRouterService.addAuthPolicy, if any.

      Further restrictions can be imposed by passing in options that control the allowed types of credential.

      You can narrow the returned credentials object to specific principal types using AuthService.isPrincipal.

    • Issues a limited access token as a cookie on the given response object. This is only possible for requests that were originally made with user credentials (such as a Backstage token).

      This must be called before sending any payload data.

      Parameters

      • res: Response

        An Express response object.

      • Optionaloptions: { credentials?: BackstageCredentials }

        Optional further settings.

        • Optionalcredentials?: BackstageCredentials

          Issue the cookie for this specific credential. Must be a "user" type principal, or a "none" type (which leads to deleting the cookie).

          Normally you do not have to specify this option, because the default behavior is to extract the credentials from the request that corresponded to the given response.

      Returns Promise<{ expiresAt: Date }>

    Settings

    Member Visibility

    On This Page

    Methods