Checksum is for integrity,not security.And I did not consider security when designing this feature. If we need consider security,I suggest adding a `secret` and give up checksum,using AEAD (like AES-256-GCM) to encrypt data,this can guarantees integrity and security at the same time.
Peter Zhu <sta...@apache.org> 于2021年5月25日周二 下午11:29写道： > Hi @fregie > > I had reviewed your PR, the way import and export are OK. > But I recommend we can add a `secret` parameter in this API. Then we can > add the `secret` field into the checksum. > This may improve security IMO. > > Best Regards! > > JunXu Chen <chenju...@apache.org> 于2021年5月25日周二 下午6:50写道： > > > hi @fregie > > > > OpenAPI is a popular api interface specification, the route export/import > > feature compatible with OpenAPI is to facilitate users to import their > > business APIs to APISIX. > > > > I accept that they are two different features. Wait for opinions from > > others. > > > > > > > > On Sat, 22 May 2021 at 15:03, Zhiyuan Ju <juzhiy...@apache.org> wrote: > > > > > Hi, > > > > > > This mail is discussing the ManagerAPI, could anyone take a look at > this > > > discuss? > > > > > > fregie zh <fregi...@gmail.com>于2021年5月19日 周三上午11:25写道： > > > > > > > > > > > > > That sounds good. Can you design the field that we need in the JSON > > > > object? > > > > > > > > > I don't get it.you mean response a json body?Then how can a user > import > > > > this json?Copy and paste?And I think we have to make sure that the > > > > configuration hasn't been tampered with,to avoid unexpected mistakes. > > > > > > > > If the field in the old version but we delete it in the new version. > > What > > > > > we should do ? > > > > > > > > > I have considered this question.We need to do forward compatibility > > and > > > > backward compatibility in the later version.We can't expect changes > in > > > the > > > > future,so we can't do compatibility in the current version. > > > > But,we can add test cases to avoid configure not compatible. > > > > > > > > There are already routing-related data import and export, and it is > > > > > compatible with OpenAPI. > > > > > Could we implement this feature on this basis? > > > > > > > > > This feature is very different from route export/import,I don't > think > > > it's > > > > a good idea implement this feature on it.Maybe we can consider > merging > > > > these two feature into one. > > > > And I don't know what purpose is the route export/import feature?And > > why > > > it > > > > need to compatible with openAPI?Can you please explain this for me? > > > > > > > > > > > > There are already routing-related data import and export, and it is > > > > > compatible with OpenAPI. > > > > > Could we implement this feature on this basis? > > > > > > > > > > On Fri, 14 May 2021 at 15:22, Peter Zhu <sta...@apache.org> wrote: > > > > > > Hello, > > > > > > > > > > > > That sounds good. Can you design the field that we need in the > JSON > > > > > object? > > > > > > And there is a situation that we should take care of. If the > field > > in > > > > the > > > > > > old version but we delete it in the new version. What we should > do > > ? > > > > > > > > > > > > Best regards! > > > > > > > > > > > > fregie zh <xiaohao950...@live.com> 于2021年5月14日周五 下午2:34写道： > > > > > > > > > > > > > 👋 Hi,everyone. > > > > > > > I proposal to add a new feature of apisix-dashbord,config > export > > > and > > > > > > > import.This feature is to migrate the configuration in > different > > > > > > > environments. > > > > > > > I plan to add two api to manager-api: > > > > > > > > > > > > > > /apisix/admin/migrate/export: > > > > > > > Epxort all related config in a json object,then add a 4 bytes > > > > checksum > > > > > to > > > > > > > end,as a file to download. > > > > > > > > > > > > > > /apisix/admin/migrate/import: > > > > > > > Upload the file exported,check file integrity,check is there > any > > > > > conflict > > > > > > > with current config. > > > > > > > if there is any conflict: > > > > > > > By default,return a error and all conflicted items. > > > > > > > Mode == skip,write all items not conflicted. > > > > > > > Mode == overwrite,write all items imported. > > > > > > > > > > > > > > What do you think of this feature? > > > > > > > -- > > > 来自 琚致远 > > > > > >
