Strongloop/loopback: how to disable authentication for User model over REST?

1
votes

I have typed in at the commandline: slc loopback:acl and disabled all security for the User model.

Going into strongloop explorer, doing a simple GET Users request gives me a 401 authorization required error.

Any ideas how to open up the User object? Is this a known bug?

Thank you

2
loopbackjsstrongloop
It is possible by extending user model and setting up permissions for your custom model, but.. I would NEVER recommend you doing this. Why would you open User or any other security related model? There is no point of doing this because intention is to secure your application. By opening this or any other security related model your application will be completely unprotected. Private user data will also be exposed to everyone. Maybe you are trying to do something else? - A.Z.
I understand your concerns. This is just for development. I want to add the login/security functionality at the end of the project. So I want to disable temporarily. - user798719

2 Answers

4
votes

You can extend your user model and set permissions for your custom model like this:

{
  "name": "CustomUser",
  "base": "User",
  "idInjection": true,
  "properties": {},
  "validations": [],
  "relations": {},
  "acls": [
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$unauthenticated",
      "permission": "ALLOW"
    },
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$authenticated",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    }
  ],
  "methods": []
}

However I would NEVER recommend you doing this.

0
votes

If you really want to disable the endpoints on the User model, you can do this.

Go to your model.config.json and add "public": false to the User field like so:

...

  "User": {
    "public": false,
    "dataSource": "db"
  },
...