[
https://issues.apache.org/jira/browse/UNOMI-1031?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Serge Huber reassigned UNOMI-1031:
----------------------------------
Assignee: Serge Huber
> Fail closed on an empty authorized-IP set for restricted event types
> --------------------------------------------------------------------
>
> Key: UNOMI-1031
> URL: https://issues.apache.org/jira/browse/UNOMI-1031
> Project: Apache Unomi
> Issue Type: Improvement
> Components: unomi(-core)
> Affects Versions: unomi-4.0.0
> Reporter: Serge Huber
> Assignee: Serge Huber
> Priority: Major
> Fix For: unomi-4.0.0
>
>
> _In short_
> A tenant with an empty authorized-IP list, which is the default for a new
> tenant, accepts restricted event types such as {{updateProperties}} from any
> public caller. They should be refused until the tenant lists the IPs allowed
> to send them.
> _Details_
> * Restricted types are {{sessionCreated}}, {{sessionReassigned}},
> {{profileUpdated}}, {{ruleFired}} and {{updateProperties}}, plus any listed
> in the tenant's {{restrictedEventTypes}}. An empty {{authorizedIPs}} is
> currently treated as "no restriction".
> * In 3.0 these events were refused unless they came from a configured
> third-party server. 4.0 should keep that default.
> * Callers using the tenant private key or administrator credentials can
> already change any profile, so they are not IP-checked.
> _Fix and test_
> Refuse restricted types when {{authorizedIPs}} is empty, and document it in
> the manual. Unit tests in {{EventServiceImplTest}}, plus a
> {{ContextServletIT}} test: refused with no IPs, accepted once the caller IP
> is listed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
