Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Export endpoint doesn't require authentication #4758

Closed
animesh2049 opened this issue Feb 11, 2020 · 2 comments · Fixed by #5162
Closed

Export endpoint doesn't require authentication #4758

animesh2049 opened this issue Feb 11, 2020 · 2 comments · Fixed by #5162
Labels
area/graphql Issues related to GraphQL support on Dgraph. area/operations Related to operational aspects of the DB, including signals, flags, env vars, etc. kind/enhancement Something could be better. status/accepted We accept to investigate/work on it.

Comments

@animesh2049
Copy link
Contributor

What version of Dgraph are you using?

v2.0.0-beta1-26-g2ad482aff

Have you tried reproducing the issue with the latest release?

Yes

Steps to reproduce the issue (command/config used to run Dgraph).

Just send request to export endopoint, it will start export.

Expected behaviour and actual result.

It should require authentication.
@MichelDiz MichelDiz added area/operations Related to operational aspects of the DB, including signals, flags, env vars, etc. kind/enhancement Something could be better. labels Feb 11, 2020
@MichelDiz
Copy link
Contributor

We need to check if this is also true via GraphQL Admin operations.

@animesh2049 animesh2049 added the status/accepted We accept to investigate/work on it. label Feb 12, 2020
@marvin-hansen
Copy link

marvin-hansen commented Feb 18, 2020 •
edited
Loading

@animesh2049

This is a prevalent issue with the GraphQL endpoint although DGraph has some mechanism to restrict admin & mutation operations through IP whitelisting and you can do some TLS stuff, if you really want.

Beyond that, you have a few options:

  1. Deploy an API manager such as Kong or Ambassador to add, proper SSL, authentication, routing and usage quotas.
  2. Use an API middleware such as Hasura
  3. Build your own API security mechanism

Eventually, I ended up with a combination of 1 & 2 due to time constraints.

At least token authentication would be great to see in the Dgraph GraphQL endpoint

@lgalatin lgalatin added area/graphql Issues related to GraphQL support on Dgraph. status/accepted We accept to investigate/work on it. and removed status/accepted We accept to investigate/work on it. labels Feb 27, 2020
@abhimanyusinghgaur abhimanyusinghgaur mentioned this issue Apr 10, 2020
Merged
abhimanyusinghgaur added a commit that referenced this issue May 19, 2020
@abhimanyusinghgaur
Add authn for graphql and http admin endpoints (#5162)
8992238 
Fixes #4758.
This PR adds authentication to following endpoints:

/admin/backup (http & graphql)
/admin/config/lru_mb (http [GET & PUT] & graphql [query & mutation])
/admin/draining (http & graphql)
/admin/export (http & graphql)
/admin/shutdown (http & graphql)
/admin/restore (graphql only)
/admin/listBackups (graphql only)
Now, all the above http endpoints and their corresponding graphql versions have following kinds of auth:

IP White-listing, if --whitelist flag is passed to alpha
Poor-man's auth, if --auth_token flag is passed to alpha
Guardian only access, if ACL is enabled
This PR also adds query for config in graphql admin, as it was missing earlier.

In addition to above points:

All the /admin endpoints apply Poor-man's auth check at http level itself, while other auth checks are routed through graphql resolvers.
GraphQL Resolvers for health/state and the ones related to ACL User/Group have IP whitelisting middleware applied, while dgraph handles Guardian auth for them.
/alter has the existing behaviour of checking only Poor-man's and Guardian auth.
GraphQL Resolvers related to schema don't apply IP whitelisting as to keep them in sync with /alter. They do apply Guardian auth.
Any GraphQL admin introspection queries don't require IP whitelisting or Guardian auth.
dna2github pushed a commit to dna2fork/dgraph that referenced this issue Jul 18, 2020
@abhimanyusinghgaur @dna2github
Add authn for graphql and http admin endpoints (hypermodeinc#5162)
f4c9a05 
Fixes hypermodeinc#4758.
This PR adds authentication to following endpoints:

/admin/backup (http & graphql)
/admin/config/lru_mb (http [GET & PUT] & graphql [query & mutation])
/admin/draining (http & graphql)
/admin/export (http & graphql)
/admin/shutdown (http & graphql)
/admin/restore (graphql only)
/admin/listBackups (graphql only)
Now, all the above http endpoints and their corresponding graphql versions have following kinds of auth:

IP White-listing, if --whitelist flag is passed to alpha
Poor-man's auth, if --auth_token flag is passed to alpha
Guardian only access, if ACL is enabled
This PR also adds query for config in graphql admin, as it was missing earlier.

In addition to above points:

All the /admin endpoints apply Poor-man's auth check at http level itself, while other auth checks are routed through graphql resolvers.
GraphQL Resolvers for health/state and the ones related to ACL User/Group have IP whitelisting middleware applied, while dgraph handles Guardian auth for them.
/alter has the existing behaviour of checking only Poor-man's and Guardian auth.
GraphQL Resolvers related to schema don't apply IP whitelisting as to keep them in sync with /alter. They do apply Guardian auth.
Any GraphQL admin introspection queries don't require IP whitelisting or Guardian auth.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/graphql Issues related to GraphQL support on Dgraph. area/operations Related to operational aspects of the DB, including signals, flags, env vars, etc. kind/enhancement Something could be better. status/accepted We accept to investigate/work on it.
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add authn for graphql and http admin endpoints hypermodeinc/dgraph
4 participants
@MichelDiz @animesh2049 @marvin-hansen @lgalatin