fix: refuser par défaut is-payload-owner sans en-tête Authorization

2026-07-04 11:35:41 +04:00
parent e515944fb9
commit bc5d0fb498
2 changed files with 3 additions and 3 deletions
@@ -6,7 +6,7 @@ module.exports = async (policyContext, config, {strapi}) => {
  const {request} = policyContext

  if (!request?.header?.authorization) {
-    return true
+    throw new UnauthorizedError('Opération non autorisée')
  }

  try {