Sidekick Library For Protected .hlx.live Sites

[Ben-Zahler]

hey!
for our portal, the .hlx.live page is protected with an access.live.allow rule in .config.
Unfortunately, this breaks our sidekick library because sidekick cannot load our blocks anymore:

library-config.js:120 
GET https://main--dme-partners--adobecom.hlx.live/docs/library/library.json net::ERR_FAILED 401 (Unauthorized) 

I see the following options:

1. send the sharepoint credentials of the user in the GET request to /docs/library/library.json

• challenge: users usually are not signed in on .hlx.live until they publish a document in the current session

2. make the path to the library configurable in sidekick, then we could e.g. point this to our akamai domain on https://partners.stage.adobe.com/edsdme/partners-shared/library/library.json
3. have the consumer implement their own version of the library in sidekick.

Option 3 is probably the quickest way to solve this, but also the least preferred for me.

[mokimo]

This currently isn't a problem on other protected sites such as cc, dc, etc. - from what I can see, those projects pull the library configs directly from milo.adobe.com. I only had a very marginal look into it, given you created this topic 5 minutes ago though 😁

You get a 401 on hlx.live - why would you disable access to hlx.live? hlx.live should be a 1:1 mapping to your production content, hence there shouldn't be any need to protect that part 🤔 ... maybe portal is special in that regard since it requires IMS-auth though.

[Ben-Zahler]

@mokimo we must protect hlx.live because we implement partner-specific access restrictions on Akamai EdgeWorkers.
cc, dc, etc don't protect hlx.live from what I know, so they don't have this issue.

So while protecting .hlx.live is a rare requirement, it's supported in EDS/Milo and therefore I think sidekick should be also working in this scenario, right?

[mokimo]

Yup, your best bet is fetching from the Akamai domain where you have more control & the edge workers can pass on the request appropriately, rather than the .page/.live domains.
As we fetch things from milo.adobe.com already, this should be possible already - if it isn't however - PRs to milo are always welcome!

[cod17828]

Hi @mokimo we have a PR to milo #3128 regarding this topic. It would be great if you could take a look.