{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/1686","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/1686/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/1686/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/1686/events","html_url":"https://github.com/strongloop/loopback/issues/1686","id":107243293,"number":1686,"title":"ACL is applied when method is POST, but not GET","user":{"login":"csvan","id":1127729,"avatar_url":"https://avatars.githubusercontent.com/u/1127729?v=3","gravatar_id":"","url":"https://api.github.com/users/csvan","html_url":"https://github.com/csvan","followers_url":"https://api.github.com/users/csvan/followers","following_url":"https://api.github.com/users/csvan/following{/other_user}","gists_url":"https://api.github.com/users/csvan/gists{/gist_id}","starred_url":"https://api.github.com/users/csvan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csvan/subscriptions","organizations_url":"https://api.github.com/users/csvan/orgs","repos_url":"https://api.github.com/users/csvan/repos","events_url":"https://api.github.com/users/csvan/events{/privacy}","received_events_url":"https://api.github.com/users/csvan/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/triage","name":"triage","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"loay","id":1986928,"avatar_url":"https://avatars.githubusercontent.com/u/1986928?v=3","gravatar_id":"","url":"https://api.github.com/users/loay","html_url":"https://github.com/loay","followers_url":"https://api.github.com/users/loay/followers","following_url":"https://api.github.com/users/loay/following{/other_user}","gists_url":"https://api.github.com/users/loay/gists{/gist_id}","starred_url":"https://api.github.com/users/loay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loay/subscriptions","organizations_url":"https://api.github.com/users/loay/orgs","repos_url":"https://api.github.com/users/loay/repos","events_url":"https://api.github.com/users/loay/events{/privacy}","received_events_url":"https://api.github.com/users/loay/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-09-18T17:24:24Z","updated_at":"2015-11-06T18:55:59Z","closed_at":null,"body":"I have the following relevant ACLs on one of my models:\r\n\r\n```\r\n    {\r\n      \"accessType\": \"*\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$everyone\",\r\n      \"permission\": \"DENY\"\r\n    },\r\n    {\r\n      \"accessType\": \"EXECUTE\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$everyone\",\r\n      \"permission\": \"ALLOW\",\r\n      \"property\": \"sendVerificationEmail\"\r\n    }\r\n```\r\n\r\nNow, this will work fine if I define `sendVerificationEmail` like so:\r\n\r\n```\r\n  MyModel.remoteMethod('sendVerificationEmail',\r\n    {\r\n      http: {path: '/sendVerificationEmail', verb: 'post'},\r\n      accepts: [\r\n        {\r\n          arg: 'id',\r\n          type: 'string',\r\n          required: true,\r\n          description: 'The id of the user.'\r\n        }\r\n      ],\r\n      returns: {\r\n        arg: 'status',\r\n        type: 'json'\r\n      }\r\n    });\r\n```\r\n\r\nIn this case, the ACL log is the following for an invocation:\r\n\r\n```\r\n  loopback:security:acl The following ACLs were searched:  +0ms\r\n  loopback:security:acl ---ACL--- +1ms\r\n  loopback:security:acl model MyModel +0ms\r\n  loopback:security:acl property sendVerificationEmail +0ms\r\n  loopback:security:acl principalType ROLE +0ms\r\n  loopback:security:acl principalId $everyone +0ms\r\n  loopback:security:acl accessType EXECUTE +0ms\r\n  loopback:security:acl permission ALLOW +0ms\r\n  loopback:security:acl with score: +0ms 8132\r\n  loopback:security:acl ---ACL--- +1ms\r\n  loopback:security:acl model MyModel +1ms\r\n  loopback:security:acl property * +0ms\r\n  loopback:security:acl principalType ROLE +0ms\r\n  loopback:security:acl principalId $everyone +0ms\r\n  loopback:security:acl accessType * +0ms\r\n  loopback:security:acl permission DENY +0ms\r\n  loopback:security:acl with score: +0ms 7495\r\n  loopback:security:acl ---ACL--- +1ms\r\n  loopback:security:acl model MyModel +0ms\r\n  loopback:security:acl property * +0ms\r\n  loopback:security:acl principalType ROLE +0ms\r\n  loopback:security:acl principalId $everyone +0ms\r\n  loopback:security:acl accessType * +0ms\r\n  loopback:security:acl permission DENY +0ms\r\n  loopback:security:acl with score: +0ms 7495\r\n  loopback:security:acl ---Resolved--- +0ms\r\n```\r\n\r\nHowever, I get 401:s if I do the following:\r\n\r\n```\r\n  MyModel.remoteMethod('sendVerificationEmail',\r\n    {\r\n      http: {path: '/:id/sendVerificationEmail', verb: 'get'},\r\n      accepts: [\r\n        {\r\n          arg: 'id',\r\n          type: 'string',\r\n          required: true,\r\n          http: {source: 'path'},\r\n          description: 'The id of the user.'\r\n        }\r\n      ],\r\n      returns: {\r\n        arg: 'status',\r\n        type: 'json'\r\n      }\r\n    });\r\n```\r\n\r\nIn this case the ACL log is:\r\n\r\n```\r\n  loopback:security:acl The following ACLs were searched:  +0ms\r\n  loopback:security:acl ---ACL--- +1ms\r\n  loopback:security:acl model MyModel +1ms\r\n  loopback:security:acl property * +0ms\r\n  loopback:security:acl principalType ROLE +0ms\r\n  loopback:security:acl principalId $everyone +0ms\r\n  loopback:security:acl accessType * +0ms\r\n  loopback:security:acl permission DENY +0ms\r\n  loopback:security:acl with score: +0ms 7495\r\n  loopback:security:acl ---ACL--- +1ms\r\n  loopback:security:acl model MyModel +0ms\r\n  loopback:security:acl property * +0ms\r\n  loopback:security:acl principalType ROLE +0ms\r\n  loopback:security:acl principalId $everyone +0ms\r\n  loopback:security:acl accessType * +0ms\r\n  loopback:security:acl permission DENY +0ms\r\n  loopback:security:acl with score: +0ms 7495\r\n  loopback:security:acl ---Resolved--- +0ms\r\n```\r\n\r\nWhy is it that the relevant ACL is not being searched when I use GET?"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/154500768","html_url":"https://github.com/strongloop/loopback/issues/1686#issuecomment-154500768","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/1686","id":154500768,"user":{"login":"loay","id":1986928,"avatar_url":"https://avatars.githubusercontent.com/u/1986928?v=3","gravatar_id":"","url":"https://api.github.com/users/loay","html_url":"https://github.com/loay","followers_url":"https://api.github.com/users/loay/followers","following_url":"https://api.github.com/users/loay/following{/other_user}","gists_url":"https://api.github.com/users/loay/gists{/gist_id}","starred_url":"https://api.github.com/users/loay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/loay/subscriptions","organizations_url":"https://api.github.com/users/loay/orgs","repos_url":"https://api.github.com/users/loay/repos","events_url":"https://api.github.com/users/loay/events{/privacy}","received_events_url":"https://api.github.com/users/loay/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T18:55:59Z","updated_at":"2015-11-06T18:55:59Z","body":"Can you pleas provide more info or a repo to reproduce the issue so I can test on my end?\r\n"}}