sergehuber commented on code in PR #843:
URL: https://github.com/apache/unomi/pull/843#discussion_r3932131530
##########
graphql/cxs-impl/src/main/java/org/apache/unomi/graphql/servlet/auth/GraphQLServletSecurityValidator.java:
##########
@@ -65,6 +66,25 @@ public GraphQLServletSecurityValidator(TenantService
tenantService,
this.executionContextManager = executionContextManager;
}
+ /**
+ * Authenticates a WebSocket upgrade. Subscriptions are never public, so
only Basic
+ * (JAAS or tenant private key) is accepted.
+ *
+ * @return true when the caller is authenticated and a security context
was established
+ */
+ public boolean validateWebSocketUpgrade(HttpServletRequest req,
HttpServletResponse res) throws IOException {
+ if (req.getHeader("Authorization") == null) {
+ res.addHeader("WWW-Authenticate", "Basic realm=\"karaf\"");
+ res.sendError(HttpServletResponse.SC_UNAUTHORIZED);
Review Comment:
Addressed in `5ca094dde` and `d571e49fe`, with one deliberate deviation from
the wording. A handshake that carries an Authorization header is authenticated
before 101, as before. A handshake that carries none — which is all a browser
can send — is upgraded and must authenticate through `connection_init` before
the socket will do anything else; a socket that does not authenticate promptly
is closed. The shipped GraphQL UI now passes the Headers-tab Authorization to
the WebSocket client as `connectionParams`, verified in a browser. Same-origin
is enforced on the upgrade. `connection_init` was chosen over a session-cookie
mechanism because Unomi has no admin session to reuse; if pre-101
authentication is a hard requirement for the browser path, that is a separate
session mechanism and worth its own change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
