Issue #3117
Updated by daviddavis over 6 years ago
@bizhang and I were a bit confused about how the jwt_secret is functioning in the API. It looks like if JWT_ALLOW_SETTING_USER_SECRET is true and DEBUG is true, I can view the field in the API for on users. However, if DEBUG is false, I can never view the field. And also, lastly, if JWT_ALLOW_SETTING_USER_SECRET is true, set, I can write to the field regardless of what DEBUG is. I wonder if (A) we can simplify this logic by eliminating the having a separate code path around DEBUG. I think this is also beneficial for testing purposes. And (B) I am wondering if the behavior around being able to write jwt_secret but not view it is intentional/correct. correct. I think this may be a refactor task. Feel free to set the tracker as such. Marking this as a bug because I am not entirely it's not a bug refactor and I am hoping for some feedback.
.