feat(rpc): Opt-in HTTP RPC API Authorization #10218
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hacdias
commented
Nov 14, 2023
lidel
requested changes
Nov 14, 2023
Jorropo
reviewed
Nov 14, 2023
|
@lidel I have some concerns / questions here:
|
lidel
changed the title
lidel
changed the title
lidel
requested changes
Nov 15, 2023
There was a problem hiding this comment.
@hacdias quick answers:
client/rpcpassing custom client is fine for now, let's keep this PR small, we can improve later (add support for creating RPC client with arbitrary options like custom headers and auth).- limiting blast radius sgtm, goal here is to establish tests, configuration and UX. we can upstream later if needed.
- yes, rename
--api-secretto--api-authand make it use the same syntax as config (basic:user:passorbearer:foo). To make UX nicer, let's assumebearerwhen:is not present in the string)
- see comments inline below
lidel
force-pushed
the
http-auth-secrets
branch
from
40e4eb8 to
25e8d3d
Compare
lidel
reviewed
Nov 15, 2023
User should be informed when access is limited.
hacdias
force-pushed
the
http-auth-secrets
branch
from
25e8d3d to
a8966e1
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #10187 ← see design requirements and purpose there.
I tried not to touch
go-ipfs-cmds. However, what I did in Kubo could've been done there too.Closes #1532
Closes #2389
CC ipfs/ipfs-webui#1586 ipfs/go-ipfs-api#172
Feature Summary
This PR provides Kubo users with a basic HTTP Auth primitives for locking the RPC API down, and exposing only a subset of commands per access token defined in
API.Authorizationmap.Future work, such as UCANs mentioned here, or sandboxing MSF, keys, IPNS names per user hinted here, could be built on top of this at a later time.