Serge Huber created UNOMI-1031:
----------------------------------
Summary: Fail closed on an empty authorized-IP set for restricted
event types
Key: UNOMI-1031
URL: https://issues.apache.org/jira/browse/UNOMI-1031
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-4.0.0
Reporter: Serge Huber
Fix For: unomi-4.0.0
_In short_
A tenant with an empty authorized-IP list, which is the default for a new
tenant, accepts restricted event types such as {{updateProperties}} from any
public caller. They should be refused until the tenant lists the IPs allowed to
send them.
_Details_
* Restricted types are {{sessionCreated}}, {{sessionReassigned}},
{{profileUpdated}}, {{ruleFired}} and {{updateProperties}}, plus any listed in
the tenant's {{restrictedEventTypes}}. An empty {{authorizedIPs}} is currently
treated as "no restriction".
* In 3.0 these events were refused unless they came from a configured
third-party server. 4.0 should keep that default.
* Callers using the tenant private key or administrator credentials can already
change any profile, so they are not IP-checked.
_Fix and test_
Refuse restricted types when {{authorizedIPs}} is empty, and document it in the
manual. Unit tests in {{EventServiceImplTest}}, plus a {{ContextServletIT}}
test: refused with no IPs, accepted once the caller IP is listed.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
