Skip to content

Conversation

@tkan145
Copy link
Contributor

@tkan145 tkan145 commented Nov 6, 2024

What

Fix THREESCALE-11435

Verification steps:

  • Checkout this branch
  • Create apicast-config.json with the following
cat <<EOF >apicast-config.json
{
  "services": [
    {
      "backend_version": "2",
      "id": "1",
      "proxy": {
        "credentials_location": "authorization",
        "hosts": [
          "one"
        ],
        "api_backend": "https://echo-api.3scale.net:443",
        "backend": {
          "endpoint": "http://localhost:8081",
          "host": "backend"                   
        },
        "policy_chain": [
          {
            "name": "routing",
            "version": "builtin",
            "enabled": true,
            "configuration": {
              "rules": [
                {
                  "url": "https://echo-api.3scale.net:443",
                  "owner_id": 119084,
                  "owner_type": "BackendApi",
                  "condition": {
                      "operations": [
                          {
                              "match": "path",
                              "op": "matches",
                              "value": "^(/test/.*|/test/?)"
                          }
                      ]
                  },
                  "replace_path": "{{uri | remove_first: '/test'}}"
                }
              ]
            }
          },
          {
            "name": "apicast.policy.apicast"
          }
        ],
        "proxy_rules": [
          {
            "http_method": "GET",
            "pattern": "/test",
            "metric_system_name": "hits",
            "delta": 1,
            "parameters": [],
            "querystring_parameters": {}
          }
        ]
      }
    }
  ]
}
EOF
  • Start development env
make development
  • Start APIcast
THREESCALE_DEPLOYMENT_ENV=staging APICAST_LOG_LEVEL=debug APICAST_WORKER=1 APICAST_CONFIGURATION_LOADER=lazy APICAST_CONFIGURATION_CACHE=0  THREESCALE_CONFIG_FILE=apicast-config.json  ./bin/apicast
  • Capture APIcast IP
APICAST_IP=$(docker inspect apicast_build_0-development-1 | yq e -P '.[0].NetworkSettings.Networks.apicast_build_0_default.IPAddress' -)
  • Send request
curl -i -k -H "Host: one" -H "Accept: application/json" "http://${APICAST_IP}:8080/?user_key="
  • You should get 401 response back
HTTP/1.1 401 Unauthorized              
Server: openresty                      
Date: Wed, 06 Nov 2024 03:25:13 GMT    
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked             
Connection: keep-alive                 
                                       
Authentication parameters missing%

@tkan145 tkan145 requested a review from a team as a code owner November 6, 2024 03:29
@tkan145 tkan145 changed the title [THREESCALE-11435] Check for nil value when decode based64 value [WIP] [THREESCALE-11435] Check for nil value when decode based64 value Nov 6, 2024
@tkan145 tkan145 force-pushed the THREESCALE-11435-basic-auth-bug branch from 3107636 to 55e4d0f Compare November 6, 2024 04:48
@tkan145 tkan145 changed the title [WIP] [THREESCALE-11435] Check for nil value when decode based64 value [THREESCALE-11435] Check for nil value when decode based64 value Nov 6, 2024
Performing a match on a nil value results in an exception being thrown
and bypassing the entire authorization validation process.
@tkan145 tkan145 force-pushed the THREESCALE-11435-basic-auth-bug branch from 55e4d0f to e2303b7 Compare November 6, 2024 05:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants