Uploaded image for project: 'Managed Service - Streams'
  1. Managed Service - Streams
  2. MGDSTRM-11135

The DELETE endpoint should return 403 when deletion is not permitted

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • False
    • None
    • False
    • No
    • ---
    • ---

      If a user requests a list of Kafkas, the list endpoint verifies if the user belongs to an organization, and, if so, it returns all the Kafkas associated with that organization (see here).

      The get endpoint follows the same logic (see here).

      However, the delete endpoint does not have this logic, which leads to a 404 error when a user attempts to delete a KAFKA instance that belongs to another user within the same organization.

      The delete endpoint needs to be updated to use the same logic as the get and list endpoints. If the requesting user does not own the KAFKA instance that results from the deletion request, a 403 error should be returned.

              Unassigned Unassigned
              mziccard Massimiliano Ziccardi
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: