Only protect some part of an API about rack-cas HOT 3 CLOSED

I'm not sure what your application looks like, but it's important to remember that rack-cas will never automatically authenticate users. It requires a 401 (unauthenticated) status to be returned by the app. So generally you can only return a 401 in the parts of your app that you want to be authenticated. This pattern gives you a lot of flexibility and it's rare to have to deal with exclude_path.

exclude_path is really only meant to be used for APIs. APIs aren't going to use CAS authentication, so you want those 401 responses to be preserved rather than being redirected to a CAS login page.

Let me know your exact situation if that isn't going to work for you and we'll see if we can work something out.

from rack-cas.

I’ll have only some part of my app that need to be authenticated. For those I can do whatever I want with 401, the other should not play with it. Since there are no such regexp that match absence of patterns, the exclude can’t do the trick. Except splitting my app, I don’t see any alternatives (and it’s a shame to split the app for one route only). Maybe I'll just step back to plain ldap authentication at nginx level ... at least I'll work, without needing a brain ;)

from rack-cas.

Well, I'd imagine a negative lookahead regular expression would do the trick. Something like:

exclude_path: /^(?!/your/authentication/required/path)/

from rack-cas.