Copilot commented on code in PR #843:
URL: https://github.com/apache/unomi/pull/843#discussion_r3742455671
##########
graphql/cxs-impl/src/main/java/org/apache/unomi/graphql/servlet/auth/GraphQLServletSecurityValidator.java:
##########
@@ -65,6 +66,25 @@ public GraphQLServletSecurityValidator(TenantService
tenantService,
this.executionContextManager = executionContextManager;
}
+ /**
+ * Authenticates a WebSocket upgrade. Subscriptions are never public, so
only Basic
+ * (JAAS or tenant private key) is accepted.
+ *
+ * @return true when the caller is authenticated and a security context
was established
+ */
+ public boolean validateWebSocketUpgrade(HttpServletRequest req,
HttpServletResponse res) throws IOException {
+ if (req.getHeader("Authorization") == null) {
+ res.addHeader("WWW-Authenticate", "Basic realm=\"karaf\"");
+ res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
Review Comment:
Requiring an `Authorization` header on the HTTP upgrade makes this endpoint
unusable from browser WebSocket clients: the browser `WebSocket` API cannot set
arbitrary request headers, and the shipped GraphQL UI constructs its client
with only a URL
(`graphql/graphql-ui/src/main/resources/assets/js/index.jsx:39`). The
Jetty-client IT can set this header, so it does not expose the incompatibility.
Please provide an authenticated browser-compatible upgrade mechanism (for
example, an established same-origin session/cookie) and wire the UI to it while
still authenticating before returning 101.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
