avniproject/avni-security#27 | Ensure blacklisted urls are blackliste…

…d even when they are unprotected
avniproject · Sep 25, 2023 · 45eabcd · 45eabcd
1 parent a01d8af
commit 45eabcd
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/avni-server-api/src/main/java/org/avni/server/framework/security/AuthenticationFilter.java b/avni-server-api/src/main/java/org/avni/server/framework/security/AuthenticationFilter.java
@@ -58,7 +58,7 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 
             AuthTokenManager authTokenManager = AuthTokenManager.getInstance();
             boolean isProtected = isProtected(request);
-            if (isProtected && ResourceProtectionStatus.isPresentIn(request, blacklistedUrls)) {
+            if (ResourceProtectionStatus.isPresentIn(request, blacklistedUrls)) {
                 response.sendError(HttpServletResponse.SC_FORBIDDEN, String.format("%s is blacklisted for the implementation", request.getServletPath()));
             } else if (isProtected) {
                 String derivedAuthToken = authTokenManager.getDerivedAuthToken(request, queryString);