CAP feature flag "restrict_all_services" is broken in latest release 6.7.1

[jhodel18]

Hi CAP team,

The feature flag `cds.env.requires.auth.restrict_all_services: false` is broken on the latest release @sap/cds@6.7.1. However, it still worked on 6.1.0.

Related cap documentation: https://cap.cloud.sap/docs/releases/jun22#auth-by-default

See below code that was completely bypassed in latest release:

@sap/cds/libx/_runtime/auth/index.js > line 163

// Security by default: set restrict_all_services if not disabled 
// this is done dynamically to also cover custom auth impl 
if (process.env.NODE_ENV === 'production' && config.restrict_all_services !== false) {
 config.restrict_all_services = true
}

[vansyckel]

Hi jhodel18,

Cannot confirm. Please provide steps to reproduce.

Best,
Sebastian

[jhodel18]

Hi vansyckel

You can use my sample project: https://github.com/jcailan/cap-fe-samples

- Do `npm i` then `npm run deploy` to deploy to CF -- this is using latest @sap/cds version

- Test the generated URL of CAP service and test any CAP endpoints.

Here's my own sample deployment: https://capfes-srv-riz-inno-dev.cfapps.us10.hana.ondemand.com/product-api/Products

It get's `Unauthorized` response.

Another deployment using @sap/cds@6.1.0 will yield the expected result -- the endpoint is not authenticated:

https://capfes-srv-riz-inno-demo.cfapps.us10.hana.ondemand.com/product-api/Products

Note that the feature flag is configured in `package.json` file.

Thanks and regards,

Jhodel

[vansyckel]

Hi jhodel18,

Thanks, can confirm now. It's caused by serving to graphql. We will look into it asap.

Best,
Sebastian

[jhodel18]

Hi Sebastian, thanks for the acknowledgment!