[go: up one dir, main page]
Skip to content

Require API authentication for GET CI Lint endpoint

Furkan Ayhanrequested to merge
limit-usage-of-ci-lint-endpoint into master

What does this MR do and why?

Require API authentication for GET CI Lint endpoint

Add authentication check to the GET :id/ci/lint endpoint to ensure requests are made with proper API authentication when a user session exists. This prevents inconsistent behavior when the endpoint is accessed through different authentication methods.

The check only applies when there is an authenticated user session but no API token present, requiring explicit API authentication for such requests.

The changes are behind the feature flag ci_require_api_token_for_ci_lint #578076.

Screenshots or screen recordings

While it works in CLI (unauthenticated):

Screenshot_2025-09-12_at_11.16.56

and unauthenticated browser:

Screenshot_2025-09-12_at_11.17.30

it gives an error on browser when authenticated:

Screenshot_2025-10-22_at_11.15.43

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Furkan Ayhan

Merge request reports