Update whitelist
As part of the redfish spec, both /redfish and /redfish/v1/odata need
to be allowed without credentials. This adds them to the whitelist,
and improves our compliance with the specification.
Change-Id: I89d7c20ed497b77cdea83560087c9085747872bf
Signed-off-by: Ed Tanous <ed.tanous@intel.com>
diff --git a/include/token_authorization_middleware.hpp b/include/token_authorization_middleware.hpp
index fcc8638..2e286e1 100644
--- a/include/token_authorization_middleware.hpp
+++ b/include/token_authorization_middleware.hpp
@@ -189,7 +189,9 @@
bool isOnWhitelist(const crow::Request& req) const {
// it's allowed to GET root node without authentica tion
if ("GET"_method == req.method()) {
- if (req.url == "/redfish/v1" || req.url == "/redfish/v1/") {
+ if (req.url == "/redfish/v1" || req.url == "/redfish/v1/" ||
+ req.url == "/redfish" || req.url == "/redfish/" ||
+ req.url == "/redfish/v1/odata" || req.url == "/redfish/v1/odata/") {
return true;
} else if (crow::webassets::routes.find(std::string(req.url)) !=
crow::webassets::routes.end()) {