How a write endpoint is authenticated — what the layer declares, and what the drain does
with it.
The drain still sends no authentication header of its own: a write is authenticated by
whoever intercepts fetch — the connector plugin, which adds its bearer token to the
requests under its base URL. The declaration is what tells the two apart from a layer that
says nothing:
"none" — the endpoint takes no credential. Every request of the write carries the
declaration as the geoleafWriteAuth member of its init, and the connector attaches
no token to it, even under its base URL.
"bearer" — the endpoint requires a session. While the session reader
(GeoLeaf.Sync.registerSessionReader) answers absent, the capture is not sent: it
stays queued, counted in the pass's heldForSession, and the pass goes on with the
captures of the other layers. With no reader
registered, or one that answers valid, expired or nothing, the capture leaves as it
always did.
absent — unchanged: the request goes out, and gets a token if it falls under the
connector's base URL.
"csrf" was removed in 3.4.0 with the core's CSRF module, which no server could verify.
How a write endpoint is authenticated — what the layer declares, and what the drain does with it.
The drain still sends no authentication header of its own: a write is authenticated by whoever intercepts
fetch— the connector plugin, which adds its bearer token to the requests under its base URL. The declaration is what tells the two apart from a layer that says nothing:"none"— the endpoint takes no credential. Every request of the write carries the declaration as thegeoleafWriteAuthmember of itsinit, and the connector attaches no token to it, even under its base URL."bearer"— the endpoint requires a session. While the session reader (GeoLeaf.Sync.registerSessionReader) answersabsent, the capture is not sent: it stays queued, counted in the pass'sheldForSession, and the pass goes on with the captures of the other layers. With no reader registered, or one that answersvalid,expiredor nothing, the capture leaves as it always did."csrf"was removed in 3.4.0 with the core's CSRF module, which no server could verify.