diff --git a/backend/infrahub/api/dependencies.py b/backend/infrahub/api/dependencies.py index cb58029c39..bb415d9443 100644 --- a/backend/infrahub/api/dependencies.py +++ b/backend/infrahub/api/dependencies.py @@ -118,7 +118,7 @@ async def get_current_user( if config.SETTINGS.main.allow_anonymous_access and request.method.lower() in ["get", "options"]: return account_session - if request.method.lower() == "post" and account_session.read_only: + if request.method.lower() == "post" and account_session.read_only and account_session.authenticated: raise PermissionDeniedError("You are not allowed to perform this operation") raise AuthorizationError("Authentication is required") diff --git a/changelog/+anonymous.fixed.md b/changelog/+anonymous.fixed.md new file mode 100644 index 0000000000..65e0f6918d --- /dev/null +++ b/changelog/+anonymous.fixed.md @@ -0,0 +1 @@ +Anonymous user will get a 401 response when trying to load a schema \ No newline at end of file