[pbs-devel] [PATCH proxmox] auth-api: remove ticket info in old create ticket endpoint
    Shannon Sterz 
    s.sterz at proxmox.com
       
    Fri May 16 15:11:22 CEST 2025
    
    
  
this should make the endpoint behave closer to how it behaved before
the HttpOnly changes. the `ticket_info` field is superfluous anyway,
as the response also includes the proper ticket in this case already.
Signed-off-by: Shannon Sterz <s.sterz at proxmox.com>
---
this came to light when Dietmar tried to use the new proxmox-yew-comp
client for authenticating against PBS. the client would default to the
new HttpOnly cookie there as it say the response contained the
ticket_info field. however, that is wrong, the old api endpoint should
not have returned this additional info, so remove it here again.
 proxmox-auth-api/src/api/access.rs | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/proxmox-auth-api/src/api/access.rs b/proxmox-auth-api/src/api/access.rs
index 396935f5..95f36f53 100644
--- a/proxmox-auth-api/src/api/access.rs
+++ b/proxmox-auth-api/src/api/access.rs
@@ -60,7 +60,13 @@ pub async fn create_ticket(
         .downcast_ref::<RestEnvironment>()
         .ok_or_else(|| format_err!("detected wrong RpcEnvironment type"))?;
-    handle_ticket_creation(create_params, env).await
+    handle_ticket_creation(create_params, env)
+        .await
+        // remove the superfluous ticket_info to not confuse clients
+        .map(|mut info| {
+            info.ticket_info = None;
+            info
+        })
 }
 pub const API_METHOD_LOGOUT: ApiMethod = ApiMethod::new(
--
2.39.5
    
    
More information about the pbs-devel
mailing list