Feature Description
When receiving requests from other backend services (not direct user-session requests), the app should require and validate the token in the authorization header.
This validation should be scoped to POST and PUT requests that cause transactions to be submitted to the blockchain. It should not be necessary for GET requests, unless they are deemed sensitive.
Feature Justification
SECURITY!
Acceptance Criteria
Feature Description
When receiving requests from other backend services (not direct user-session requests), the app should require and validate the token in the authorization header.
This validation should be scoped to
POSTandPUTrequests that cause transactions to be submitted to the blockchain. It should not be necessary forGETrequests, unless they are deemed sensitive.Feature Justification
SECURITY!
Acceptance Criteria