HTTP API: Disallow GET requests #7097

hsanjuan · 2020-04-04T00:13:40Z

Better security by limiting the HTTP API to POST requests. (see commit descriptions).

hsanjuan · 2020-04-04T00:14:46Z

This might break tests, not sure, I will fix those on another day.

core/corehttp/commands.go

hsanjuan · 2020-04-04T16:45:12Z

I have a test failure that seems unrelated:

=== Failed
=== FAIL: core/coreapi/test TestIface/Dht/TestDhtFindPeer (1.29s)
panic: runtime error: index out of range [0] with length 0 [recovered]
	panic: runtime error: index out of range [0] with length 0

hsanjuan · 2020-04-04T16:50:04Z

@lidel can you help with the webui test failure (I have the feeling it will take you way shorter than me to figure out the place to fix it).

lidel · 2020-04-04T16:56:20Z

I will take a look as soon I get back home (eta 1h)

Update: see ipfs/ipfs-webui#1429

hsanjuan · 2020-04-04T19:08:26Z

Ok:

Sharness is green

Pending:

Reviews
Need to merge and bubble Fix: calls to IPFS API should use POST, not GET. iptb-plugins#37
Need to fix webui test
Final squash and fix commit messages.

ipfs/kubo#7097 will block `GET` commands on API port, switching everything to POST. This breaks Files screen in ipfs-webui as noted in ipfs/ipfs-webui#1429 ipfs-webui is using older version of js-ipfs-http-client, one before huge refactor into async iterables, which means switching to the latest version won't be a trivial task. For now, we just apply simple patch on top of ipfs-http-client v39.0.2 to ensure it sends commands as POST. Proper fix will land when ipfs-webui is refactored to work with ipfs-http-client >41.x Closes #1429

ipfs/kubo#7097 will block `GET` commands on API port, switching everything to POST. This breaks Files screen in ipfs-webui as noted in #1429 ipfs-webui is using older version of js-ipfs-http-client, one before huge refactor into async iterables, which means switching to the latest version won't be a trivial task. For now, we just apply simple patch on top of ipfs-http-client v39.0.2 to ensure it sends commands as POST. Proper fix will land when ipfs-webui is refactored to work with ipfs-http-client >41.x Closes #1429

* fix: support POST-only HTTP API ipfs/kubo#7097 will block `GET` commands on API port, switching everything to POST. This breaks Files screen in ipfs-webui as noted in #1429 ipfs-webui is using older version of js-ipfs-http-client, one before huge refactor into async iterables, which means switching to the latest version won't be a trivial task. For now, we just apply simple patch on top of ipfs-http-client v39.0.2 to ensure it sends commands as POST. Proper fix will land when ipfs-webui is refactored to work with ipfs-http-client >41.x Closes #1429 * docs: remove GET from CORS setup for API

core/corehttp/commands.go

This commit upgrades go-ipfs-cmds and configures the commands HTTP API Handler to only allow POST/OPTIONS, disallowing GET and others in the handling of command requests in the IPFS HTTP API (where before every type of request method was handled, with GET/POST/PUT/PATCH being equivalent). The Read-Only commands that the HTTP API attaches to the gateway endpoint will additional handled GET as they did before (but stop handling PUT,DELETEs). By limiting the request types we address the possibility that a website accessed by a browser abuses the IPFS API by issuing GET requests to it which have no Origin or Referrer set, and are thus bypass CORS and CSRF protections. This is a breaking change for clients that relay on GET requests against the HTTP endpoint (usually :5001). Applications integrating on top of the gateway-read-only API should still work (including cross-domain access). Co-Authored-By: Steven Allen <steven@stebalien.com> Co-Authored-By: Marcin Rataj <lidel@lidel.org>

…Allowed Spec says that response with 405 must set Allow headers.

lidel · 2020-04-05T22:12:45Z

PSA: this will require IPFS Companion v2.11.x or later (shipped a Beta for testing: v2.11.0.904)

ntninja · 2020-04-17T08:51:50Z

Of course I'll adapt to this in py-ipfs-http-client, but may I ask what the rationale is/was for blocking GET on idempotent & read-only API endpoints? Why can't things like /api/v0/get?arg=<cid> continue to be allowed GET access additionally to POST?

Stebalien · 2020-04-17T09:03:47Z

Basically, the HTTP API is not a REST API, it's a simple RPC API. In go-ipfs, at least, it's defined as a set of transport agnostic commands, then exposed through an HTTP API.

Note: You can continue to use GET requests against the read-only API on the gateway.

ntninja · 2020-04-17T09:24:35Z

Too bad 🙁… I have some code deployed that uses the HTTP API as read-only API since its port is stable (5001) while the gateway port is unusable (8080 is way to generic).

The decision to also enforce this for the read-only parts of the API parts that are also exposed via the gateway is final, I suppose? Does the read-only API exposed via the gateway support using POST or does it only support GET instead?

hsanjuan · 2020-04-17T12:57:50Z

Does the read-only API exposed via the gateway support using POST or does it only support GET instead?

I think both.

Stebalien · 2020-04-17T17:21:21Z

We have no intention of changing this as it simplifies reasoning about the system. Is it not possible for you to use POST?

lidel · 2020-04-17T23:39:35Z

@Alexander255 @hsanjuan 👉 POST-only is required only on the API port

A subset of /api/v0 exposed on the Gateway accepts GET just fine (0.5.0-rc2), and that is ok (no reason to block it, as far I can tell):

$ curl -X GET http://127.0.0.1:5001/api/v0/dns/ipfs.io
405 - Method Not Allowed

$ curl -X GET http://127.0.0.1:8080/api/v0/dns/ipfs.io
{"Path":"/ipfs/bafybeibdwwmb725qy4yph56jg4bs6uimcst5hnvuraarowgdaytzmgsw24"}

ntninja · 2020-04-18T15:52:36Z

With the read-only API on gateway supporting POST, I can still pretend they are the same so no problem for me then. I just feels weird to use POST there, but if it makes stuff easier for you so be it. 👍

HTTP API: Only allow POST requests (plus OPTIONS) This commit was moved from ipfs/kubo@3304c28

hsanjuan requested review from lidel and Stebalien April 4, 2020 00:13

hsanjuan self-assigned this Apr 4, 2020

ribasushi reviewed Apr 4, 2020

View reviewed changes

core/corehttp/commands.go Outdated Show resolved Hide resolved

hsanjuan changed the title ~~HTTP API: Only allow POST requests (plus OPTIONS, HEAD)~~ HTTP API: Only allow POST requests (plus OPTIONS) Apr 4, 2020

lidel mentioned this pull request Apr 4, 2020

Support POST-only HTTP API ipfs/ipfs-webui#1429

Closed

1 task

hsanjuan force-pushed the fix/api-post branch from 03534bc to c3953b9 Compare April 4, 2020 17:49

lidel mentioned this pull request Apr 4, 2020

fix: support POST-only HTTP API ipfs-inactive/ipfs-redux-bundle#38

Closed

lidel mentioned this pull request Apr 4, 2020

fix: support POST-only HTTP API ipfs/ipfs-webui#1430

Merged

Stebalien approved these changes Apr 4, 2020

View reviewed changes

Stebalien reviewed Apr 4, 2020

View reviewed changes

core/corehttp/commands.go Outdated Show resolved Hide resolved

hsanjuan and others added 2 commits April 5, 2020 09:57

corehttp: Gateway handler: add Allow headers when returning MethodNot…

7340543

…Allowed Spec says that response with 405 must set Allow headers.

hsanjuan force-pushed the fix/api-post branch from e6f1cb2 to 7340543 Compare April 5, 2020 07:58

hsanjuan changed the title ~~HTTP API: Only allow POST requests (plus OPTIONS)~~ HTTP API: Disallow GET requests Apr 5, 2020

lidel mentioned this pull request Apr 5, 2020

feat: *.localhost subdomain gateway support with http proxy ipfs/ipfs-companion#853

Merged

20 tasks

Stebalien merged commit 3304c28 into master Apr 5, 2020

Stebalien deleted the fix/api-post branch April 5, 2020 17:14

This was referenced Apr 5, 2020

POST-only HTTP API ipfs/js-ipfs#2971

Closed

fix: support POST-only HTTP API ipfs-inactive/ipfs-redux-bundle#39

Merged

feat: support for go-ipfs 0.5 ipfs/ipfs-desktop#1392

Merged

odisseus mentioned this pull request Apr 21, 2020

Support for IPFS 0.6.x propensive/fury-old#1283

Closed

lidel mentioned this pull request Apr 21, 2020

fix: support POST-only API of go-ipfs 0.5 orbitdb/orbitdb#782

Merged

This was referenced Apr 28, 2020

client.id() is rejected when using go-ipfs beyond v0.4.23 ipfs-shipyard/py-ipfs-http-client#212

Closed

HEAD method is advertised in the API but not allowed #7242

Closed

andrew mentioned this pull request May 22, 2020

Support for go-ipfs v0.5 tomibennett/ruby-ipfs-http-client#59

Closed

luoweb pushed a commit to luoweb/java-ipfs-http-client that referenced this pull request May 24, 2020

the bug with ipfs/kubo/pull/7097

c917bd8

benjlevesque mentioned this pull request Jun 23, 2022

feat(ipfs-manager): adapt RPC usage with POST methods RequestNetwork/requestNetwork#871

Merged

hacdias pushed a commit to ipfs/boxo that referenced this pull request Jan 27, 2023

Merge pull request ipfs/kubo#7097 from ipfs/fix/api-post

eb70087

HTTP API: Only allow POST requests (plus OPTIONS) This commit was moved from ipfs/kubo@3304c28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

HTTP API: Disallow GET requests #7097

HTTP API: Disallow GET requests #7097

hsanjuan commented Apr 4, 2020 •

edited

Loading

hsanjuan commented Apr 4, 2020

hsanjuan commented Apr 4, 2020

hsanjuan commented Apr 4, 2020

lidel commented Apr 4, 2020 •

edited

Loading

hsanjuan commented Apr 4, 2020 •

edited

Loading

lidel commented Apr 5, 2020

ntninja commented Apr 17, 2020

Stebalien commented Apr 17, 2020

ntninja commented Apr 17, 2020 •

edited

Loading

hsanjuan commented Apr 17, 2020

Stebalien commented Apr 17, 2020

lidel commented Apr 17, 2020 •

edited

Loading

ntninja commented Apr 18, 2020

HTTP API: Disallow GET requests #7097

HTTP API: Disallow GET requests #7097

Conversation

hsanjuan commented Apr 4, 2020 • edited Loading

hsanjuan commented Apr 4, 2020

hsanjuan commented Apr 4, 2020

hsanjuan commented Apr 4, 2020

lidel commented Apr 4, 2020 • edited Loading

hsanjuan commented Apr 4, 2020 • edited Loading

lidel commented Apr 5, 2020

ntninja commented Apr 17, 2020

Stebalien commented Apr 17, 2020

ntninja commented Apr 17, 2020 • edited Loading

hsanjuan commented Apr 17, 2020

Stebalien commented Apr 17, 2020

lidel commented Apr 17, 2020 • edited Loading

ntninja commented Apr 18, 2020

hsanjuan commented Apr 4, 2020 •

edited

Loading

lidel commented Apr 4, 2020 •

edited

Loading

hsanjuan commented Apr 4, 2020 •

edited

Loading

ntninja commented Apr 17, 2020 •

edited

Loading

lidel commented Apr 17, 2020 •

edited

Loading