Weird wildcard route behaviour when specifying methods

Hi,

while working on a new personal project, I’ve noticed a strange behaviour for wildcard routes:

I’ve configured the following route:

{
    "routes": [
        {
            "route": "/api/*",
            "methods": [
                "PUT",
                "POST",
                "DELETE"
            ],
            "allowedRoles": [
                "admin"
            ]
        }
    ]
}

In addition, in the project I have the following C# API:

• GET /api/books (gets all books in Database)
• GET /api/books/{id} (gets the book with {id} from the db)
• POST, PUT and DELETE for the books are only mocked via proxies.json

The behaviour I’d expect from my understanding is that the GET requests should be available to all users, while POST, PUT and DELETE should require a logged in user with the admin role.

However, when activating this route, I get a 403 error for all methods when I’m unauthenticated. Once i remove the route again, every method returns their backend success code.

I’m testing on Windows with azure/static-web-apps-cli@0.3.0.

Am I missing something or is there a better way to imlement such a authentication requirement?

I’d appreciate any help!

[anthonychu]

This should be fixed with #208 and released in v0.5.0.

@manekinekko While the rule now blocks requests correctly, it seems to return the wrong HTTP status code (returns 404 when not authenticated/authorized, instead of 401 or 403).

Repro: https://github.com/anthonychu/20210601-swa-cli-issue-190

swa start --api api

If you click the button and look at the browser dev tools, you’ll see the POST request returns 404 instead of 401.

[miwebst]

@manekinekko I think this is a bug in the swa cli, can you take a look?