{"action":"created","issue":{"url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/43","repository_url":"https://api.github.com/repos/FusionAuth/fusionauth-issues","labels_url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/43/comments","events_url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/43/events","html_url":"https://github.com/FusionAuth/fusionauth-issues/issues/43","id":383412169,"node_id":"MDU6SXNzdWUzODM0MTIxNjk=","number":43,"title":"Retrieving a user by specified keys are being ignored when a JWT cookie is available. ","user":{"login":"rfg-anthony-lim","id":45254265,"node_id":"MDQ6VXNlcjQ1MjU0MjY1","avatar_url":"https://avatars1.githubusercontent.com/u/45254265?v=4","gravatar_id":"","url":"https://api.github.com/users/rfg-anthony-lim","html_url":"https://github.com/rfg-anthony-lim","followers_url":"https://api.github.com/users/rfg-anthony-lim/followers","following_url":"https://api.github.com/users/rfg-anthony-lim/following{/other_user}","gists_url":"https://api.github.com/users/rfg-anthony-lim/gists{/gist_id}","starred_url":"https://api.github.com/users/rfg-anthony-lim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfg-anthony-lim/subscriptions","organizations_url":"https://api.github.com/users/rfg-anthony-lim/orgs","repos_url":"https://api.github.com/users/rfg-anthony-lim/repos","events_url":"https://api.github.com/users/rfg-anthony-lim/events{/privacy}","received_events_url":"https://api.github.com/users/rfg-anthony-lim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"robotdan","id":1148709,"node_id":"MDQ6VXNlcjExNDg3MDk=","avatar_url":"https://avatars3.githubusercontent.com/u/1148709?v=4","gravatar_id":"","url":"https://api.github.com/users/robotdan","html_url":"https://github.com/robotdan","followers_url":"https://api.github.com/users/robotdan/followers","following_url":"https://api.github.com/users/robotdan/following{/other_user}","gists_url":"https://api.github.com/users/robotdan/gists{/gist_id}","starred_url":"https://api.github.com/users/robotdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robotdan/subscriptions","organizations_url":"https://api.github.com/users/robotdan/orgs","repos_url":"https://api.github.com/users/robotdan/repos","events_url":"https://api.github.com/users/robotdan/events{/privacy}","received_events_url":"https://api.github.com/users/robotdan/received_events","type":"User","site_admin":false},"assignees":[{"login":"robotdan","id":1148709,"node_id":"MDQ6VXNlcjExNDg3MDk=","avatar_url":"https://avatars3.githubusercontent.com/u/1148709?v=4","gravatar_id":"","url":"https://api.github.com/users/robotdan","html_url":"https://github.com/robotdan","followers_url":"https://api.github.com/users/robotdan/followers","following_url":"https://api.github.com/users/robotdan/following{/other_user}","gists_url":"https://api.github.com/users/robotdan/gists{/gist_id}","starred_url":"https://api.github.com/users/robotdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robotdan/subscriptions","organizations_url":"https://api.github.com/users/robotdan/orgs","repos_url":"https://api.github.com/users/robotdan/repos","events_url":"https://api.github.com/users/robotdan/events{/privacy}","received_events_url":"https://api.github.com/users/robotdan/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-11-22T07:35:23Z","updated_at":"2018-11-22T15:46:36Z","closed_at":null,"author_association":"NONE","body":"## Retrieving a user by specified keys are being ignored when a JWT cookie is available. \r\n\r\n### Description \r\nI installed version 1.2.1\r\nhttps://fusionauth.io/docs/v1/tech/apis/users#retrieve-a-user\r\nWhen trying to retrieve User endpoints such as below, they only return the user profile of the JWT cookie user; they do not return the user profile of the requested user key:\r\n/api/user/{userId}\r\n/api/user?loginId={loginId}\r\n/api/user?email={email}\r\n/api/user?username={username}\r\n\r\n### Steps to reproduce\r\nSteps to reproduce the behavior:\r\n1. Authenticate using /api/login using your API client. I use Insomnia app. \r\n```\r\n> POST /api/login HTTP/1.1\r\n> Host: xxx.xxx.xxx.xxx:9011\r\n> User-Agent: insomnia/6.2.0\r\n> Content-Type: application/json\r\n> X-Forwarded-For: ::\r\n> X-FusionAuth-TenantId: <My Tenant Uuid>\r\n> Accept: */*\r\n> Content-Length: 268\r\n| {\r\n| \t\"loginId\": \"user1\",\r\n| \t\"password\": \"password\",\r\n| \t\"ipAddress\": \"127.0.0.1\",\r\n| \t\"device\": \"XXX\",\r\n| \t\"metaData\": {\r\n| \t\t\"device\": {\r\n| \t\t\t\"description\": \"Insomnia App\",\r\n| \t\t\t\"lastAccessedAddress\": \"127.0.0.1\",\r\n| \t\t\t\"name\": \"Insomnia\",\r\n| \t\t\t\"type\": \"OTHER\"\r\n| \t\t}\r\n| \t}\r\n| }\r\n< HTTP/1.1 212 access_token=\"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1NDI4NTk4MzIsImlhdCI6MTU0Mjg1NjIzMiwiaXNzIjoiMTcyLjE2LjAuMjIyOjkwMTEiLCJzdWIiOiJlNWZiNmE5Ny01ZWFmLTRjZjMtODJhYy1mNDMzOWUyM2NkNzAiLCJhdXRoZW50aWNhdGlvblR5cGUiOiJQQVNTV09SRCIsImVtYWlsIjoidXNlcjFAcmVkZmxhZ2dyb3VwLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZX0._kUQmTKFdG1PoO1BOm9F6Sk_L7k34R83hQSDodMHqbU\" for domain xxx.xxx.xxx.xxx, path /, expire 0\r\n< Set-Cookie: access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1NDI4NzQ2NDQsImlhdCI6MTU0Mjg3MTA0NCwiaXNzIjoiMTcyLjE2LjAuMjIyOjkwMTEiLCJzdWIiOiI1NDcyYzU3MC0zOTJiLTQxOTYtYTdmNC0xYzg4Yjc0NDEwNzEiLCJhdXRoZW50aWNhdGlvblR5cGUiOiJQQVNTV09SRCIsImVtYWlsIjoiZnVzaW9uYXV0aEBtYWlsbmVzaWEuY29tIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlfQ.SaVgDC9xCM154crNCnOSGVG7qoR5BOkpblaZz1tSeo8; Path=/; HttpOnly\r\n< Content-Type: application/json;charset=UTF-8\r\n< Content-Length: 907\r\n< Date: Thu, 22 Nov 2018 07:17:24 GMT\r\n\r\n* Received 833 B chunk\r\n* Connection #3 to host xxx.xxx.xxx.xxx left intact\r\n* Saved 1 cookie\r\n```\r\n2. Retrieve user by Id /api/user/25a872da-bb44-4af8-a43d-e7bcb5351ebc; It doesn't have to be an existing User UUID. Your API Client should be sending the token cookie automatically. \r\n```\r\n> GET /api/user/25a872da-bb44-4af8-a43d-e7bcb5351ebc HTTP/1.1\r\n> Host: xxx.xxx.xxx.xxx:9011\r\n> User-Agent: insomnia/6.2.0\r\n> Cookie: access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1NDI4NzQ2NDQsImlhdCI6MTU0Mjg3MTA0NCwiaXNzIjoiMTcyLjE2LjAuMjIyOjkwMTEiLCJzdWIiOiI1NDcyYzU3MC0zOTJiLTQxOTYtYTdmNC0xYzg4Yjc0NDEwNzEiLCJhdXRoZW50aWNhdGlvblR5cGUiOiJQQVNTV09SRCIsImVtYWlsIjoiZnVzaW9uYXV0aEBtYWlsbmVzaWEuY29tIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlfQ.SaVgDC9xCM154crNCnOSGVG7qoR5BOkpblaZz1tSeo8\r\n> X-Forwarded-For: ::\r\n> X-FusionAuth-TenantId: <My Tenant Uid>\r\n> Authorization: <My API Key>\r\n> Accept: */*\r\n< HTTP/1.1 200 \r\n< Content-Type: application/json;charset=UTF-8\r\n< Content-Length: 553\r\n< Date: Thu, 22 Nov 2018 07:21:18 GMT\r\n\r\n* Received 553 B chunk\r\n* Connection #36 to host 172.16.0.222 left intact\r\n{\r\n  \"user\": {\r\n    \"active\": true,\r\n    \"birthDate\": \"1914-11-21\",\r\n    \"email\": \"fusionauth@mailnesia.com\",\r\n    \"expiry\": 1543507200000,\r\n    \"firstName\": \"Mail\",\r\n    \"fullName\": \"Mail Nesia\",\r\n    \"id\": \"5472c570-392b-4196-a7f4-1c88b7441071\",\r\n    \"insertInstant\": 1542768797248,\r\n    \"lastLoginInstant\": 1542871044096,\r\n    \"lastName\": \"Nesia\",\r\n    \"mobilePhone\": \"+85254000455\",\r\n    \"passwordChangeRequired\": false,\r\n    \"passwordLastUpdateInstant\": 1542769401224,\r\n    \"tenantId\": \"e360a05d-ef17-4336-a82f-b3e69320d036\",\r\n    \"twoFactorDelivery\": \"TextMessage\",\r\n    \"twoFactorEnabled\": true,\r\n    \"username\": \"fusionauth\",\r\n    \"usernameStatus\": \"ACTIVE\",\r\n    \"verified\": false\r\n  }\r\n}\r\n```\r\n3. Look at the response body. It returns the user profile of the JWT owner, not 404 or the profile of the specified UUID. \r\n\r\n### Expected behavior\r\nThe API should return the user profile of the specified key -- uuid, loginId, email, username, etc.\r\n\r\n### Screenshots\r\nNo screenshots. I've already sent the detailed HTTP communication. \r\n\r\n### Platform\r\n - Device: Desktop and Laptop\r\n - OS: OS: Windows 10 (Client), Ubuntu 18.10 (Server)\r\n - Insomnia 6.2.0\r\n\r\n### Additional context\r\nIt seems that the path or request arguments are being ignored when a JWT cookie exists. "},"comment":{"url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/comments/441067957","html_url":"https://github.com/FusionAuth/fusionauth-issues/issues/43#issuecomment-441067957","issue_url":"https://api.github.com/repos/FusionAuth/fusionauth-issues/issues/43","id":441067957,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTA2Nzk1Nw==","user":{"login":"robotdan","id":1148709,"node_id":"MDQ6VXNlcjExNDg3MDk=","avatar_url":"https://avatars3.githubusercontent.com/u/1148709?v=4","gravatar_id":"","url":"https://api.github.com/users/robotdan","html_url":"https://github.com/robotdan","followers_url":"https://api.github.com/users/robotdan/followers","following_url":"https://api.github.com/users/robotdan/following{/other_user}","gists_url":"https://api.github.com/users/robotdan/gists{/gist_id}","starred_url":"https://api.github.com/users/robotdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robotdan/subscriptions","organizations_url":"https://api.github.com/users/robotdan/orgs","repos_url":"https://api.github.com/users/robotdan/repos","events_url":"https://api.github.com/users/robotdan/events{/privacy}","received_events_url":"https://api.github.com/users/robotdan/received_events","type":"User","site_admin":false},"created_at":"2018-11-22T15:46:36Z","updated_at":"2018-11-22T15:46:36Z","author_association":"MEMBER","body":"Thanks @rfg-anthony-lim for the excellent details. \r\n\r\nThis is the currently intended behavior for this API. The intention of this design was that if you are logged into FusionAuth you may retrieve your own user profile. In this scenario, regardless of the UUID you provide on the URL it will be ignored and replaced with the `sub` claim from the provided JWT. \r\n\r\nI can review this design with team and see how to handle this issue.\r\n\r\nA couple of options exist to address this issue:\r\n\r\n1. Prefer the API key if present, and in that case ignore the JWT (provided as a cookie or an Auth header)\r\n2. If a UUID is requested other than that matching the `sub` claim in the JWT, return a `404` or perhaps more appropriate a `401` or `403`. \r\n3. Remove the option to use a JWT with this API as a form of authentication\r\n4. No change\r\n\r\nI can see why this behavior can be confusing. However, is this a real use case you plan to utilize? \r\n\r\nFor example, will you have a user :\r\n1. Log into FusionAuth with a user-agent based application which will store a cookie\r\n2. Make an API call to the User API from that same user-agent based application using an API key \r\n\r\nGenerally speaking because a user-agent based application is not considered secure, API keys are not stored or utilized in this domain.\r\n\r\nIn my opinion this scenario is not likely, but I may be missing another use case, so if you have another one in mind please describe it for me so I can better prioritize this issue.\r\n\r\n\r\n\r\n"}}
{"actor":{"display_login":"robotdan"}}