{"action":"created","issue":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/270","labels_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/270/labels{/name}","comments_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/270/comments","events_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/270/events","html_url":"https://github.com/simplabs/ember-simple-auth/issues/270","id":39781669,"number":270,"title":"$.ajaxPrefilter hooking strategy too global?","user":{"login":"jayphelps","id":762949,"avatar_url":"https://avatars.githubusercontent.com/u/762949?v=3","gravatar_id":"","url":"https://api.github.com/users/jayphelps","html_url":"https://github.com/jayphelps","followers_url":"https://api.github.com/users/jayphelps/followers","following_url":"https://api.github.com/users/jayphelps/following{/other_user}","gists_url":"https://api.github.com/users/jayphelps/gists{/gist_id}","starred_url":"https://api.github.com/users/jayphelps/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jayphelps/subscriptions","organizations_url":"https://api.github.com/users/jayphelps/orgs","repos_url":"https://api.github.com/users/jayphelps/repos","events_url":"https://api.github.com/users/jayphelps/events{/privacy}","received_events_url":"https://api.github.com/users/jayphelps/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":24,"created_at":"2014-08-08T00:25:31Z","updated_at":"2015-07-21T05:33:42Z","closed_at":null,"body":"Since ember-simple-auth uses `$.ajaxPrefilter`, literally *any* calls that end up using `jQuery.ajax` will trigger the prefilter callback and run against any `Authorizer` defined.\r\n\r\nThis steps on the toes of other libraries and code paths that rely on jQuery's AJAX helpers, as well as makes it impossible to conditionally authorize certain models different ways (or selectively not authorize some).\r\n\r\nAny alternatives?"},"comment":{"url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/comments/123166973","html_url":"https://github.com/simplabs/ember-simple-auth/issues/270#issuecomment-123166973","issue_url":"https://api.github.com/repos/simplabs/ember-simple-auth/issues/270","id":123166973,"user":{"login":"abradner","id":445235,"avatar_url":"https://avatars.githubusercontent.com/u/445235?v=3","gravatar_id":"","url":"https://api.github.com/users/abradner","html_url":"https://github.com/abradner","followers_url":"https://api.github.com/users/abradner/followers","following_url":"https://api.github.com/users/abradner/following{/other_user}","gists_url":"https://api.github.com/users/abradner/gists{/gist_id}","starred_url":"https://api.github.com/users/abradner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abradner/subscriptions","organizations_url":"https://api.github.com/users/abradner/orgs","repos_url":"https://api.github.com/users/abradner/repos","events_url":"https://api.github.com/users/abradner/events{/privacy}","received_events_url":"https://api.github.com/users/abradner/received_events","type":"User","site_admin":false},"created_at":"2015-07-21T05:33:42Z","updated_at":"2015-07-21T05:33:42Z","body":"I'm joining the party here late, I know, but I had an idea that might interest you:\r\n\r\nFirst, it seems like we're trying to have an ideal solution for two opposing ideas:\r\n1) Have a drop-in, zero config auth toolbelt that just works\r\n2) Have an extensible auth platform that can handle all everything you throw at it.\r\n\r\nHaving both of these in the core library may well be either impossible or very convoluted, but the Ember team solved a similar problem fairly elegantly: Addons.\r\n\r\nUnder this model, the Authorization header can be opt-in under the core framework, but with another addon, say ember-simple-auth-automatic, users can get the current behaviour for free. This could be the recommended path for new users or even an enabled default in a vanilla install.\r\n\r\nThere are a lot of good reasons for having the auth header as opt-in, mostly to do with ajax calls to a third party, eg directly consuming Google's APIs while also using your own OAuth backend.\r\n\r\nBy being explicit when making a call, you can:\r\n* support interaction with multiple simultaneous OAuth providers in the future with little effort\r\n* ensure that the right tokens get sent to the right places\r\n* ensure you're not accidentally leaking your access tokens to a potentially malicious third party (and this could be a BIG trap).\r\n\r\nAs for the explicit calls, instances of `$.ajax()` could be trivially replaced with `this.get('session.myAuthProvider').ajax()`\r\nand in true ember/semver form, that could be a feature introduced in the 1.x stream (initially with a feature flag while it's under development) with deprecation warnings when you directly use $.ajax(), then finally extracted into the addon for 2.0, keeping everyone happy.\r\n"}}