Zaqar doesn't require X-PROJECT-ID header in requests (noauth)

[Eva Balycheva]

My Zaqar is configured to use 'noauth' authentication back end.

When I don't provide X-PROJECT-ID header in my requests, Zaqar processes my requests without showing any errors.

Seems like X-PROJECT-ID header don't go through any validation. I'm able to use any string as X-PROJECT-ID header.
See some recourds from mongodb Zaqar "queues" collection: http://paste.openstack.org/show/epN5OE88C39W4szjN5d8/

All requests seem to be working normally with any X-PROJECT-ID header. Maybe it's not a bug.

But according to Wiki (https://wiki.openstack.org/wiki/Zaqar/specs/api/v1): "If auth is not enabled, clients must provide the X-Project-Id header themselves."

[wangxiyuan (wangxiyuan)]

IMO, noauth means that anyone could do anything with zaqar. So the user could get all queues information. If so, do we really want project id here?

On the other hand, according to the wiki, I guess it hope that noauth could work the same as keystone auth except token verify. If so, we indeed need users provide project-id.

I prefer to leave the noauth as it is. And which one is better depends on the design and the use case of Zaqar. Maybe I'm wrong as well. Thought?

[Eva Balycheva (ubershy)]

Yes, I think now too that it's better to leave noauth as it is. X-project-id validation should have been implemented from the start, now it's too late and if we will fix it, this change might be breaking for someone. Also Zaqar works normally with any x-project-id header. So better to keep it as is.