bitflicker64 opened a new pull request, #3189:
URL: https://github.com/apache/hugegraph/pull/3189
## Purpose of the PR
- close #3188
PD's REST interceptor decodes the Basic credential, keeps only the part
before the colon, and checks it against the fixed set `hg`, `store`, `hubble`,
`vermeer`. Any of those names with any password, including an empty one, is
treated as an internal component; the password is never read. Separately,
`RestAuthentication.preHandle` writes an error body without calling
`setStatus`, so success, refusal and missing credential all return HTTP 200 and
nothing keyed on a status code (monitors, `curl -f`, the shipped healthchecks)
can see a refusal. The endpoints behind the interceptor mutate the cluster:
`POST /v1/members/change`, `DELETE /v1/store/{storeId}`, graph and graphspace
writes, and the balance and patrol tasks. The issue has the measured 27-request
matrix.
## Main Changes
- `Authentication.authenticate` now reads the password and compares it
(constant-time, `MessageDigest.isEqual`) with the shared secret from
`auth.secret-key`, a `PDConfig` key that already existed but was only
referenced by dead code. The service-name check stays. A missing or empty
secret refuses every request instead of falling back to name-only
authentication.
- `RestAuthentication.preHandle` sets 401 for a missing, malformed or
refused credential. The JSON error body is unchanged.
- `auth.secret-key` now appears in both shipped `application.yml` files with
a change-in-production note, and the PD Docker image accepts an optional
`HG_PD_AUTH_SECRET_KEY` env, written into `SPRING_APPLICATION_JSON` and never
logged.
- In-repo clients are wired to match: `wait-storage.sh` defaults its PD
password to the shipped secret (its old `admin` default only passed because the
password was ignored), and the Compose Hubble properties files set
`operations.pd.username` and `operations.pd.password`.
- PD test credentials switch from `store:123` / `store:admin` to the shipped
secret, and `RestApiTest` gains four cases asserting 401 for a missing
credential, a wrong password, an empty password and an unknown service name.
- The `hugegraph-pd` and `docker` READMEs document the credential and state
that the shipped default secret is public, so operators must change it or keep
port 8620 off shared networks.
This intentionally refuses any client that sent a valid name with an
arbitrary password, which is why it targets 1.8.0 (see the issue for the
release-boundary reasoning). Remaining wiring lives outside this repo: Hubble's
own PD calls on the toolchain side, the Helm chart's Secret in #3132, and the
same note for the website docs. Probes are untouched; #3185 keeps `/v1/ready`
off the authenticated surface for exactly that reason.
## Verifying these changes
- [ ] Trivial rework / code cleanup without any test coverage. (No Need)
- [ ] Already covered by existing tests, such as *(please modify tests
here)*.
- [x] Need tests and can be verified as follows:
- `RestApiTest` (run by `pd-rest-test` in CI against a live PD) now
asserts 401 for a missing credential, a wrong password, an empty password and
an unknown service name, and keeps asserting 200 with a valid credential on the
existing endpoints.
- Measured on 2026-09-03 against the packaged dist (JDK 11):
`/v1/members` and `/v1/stores` return 401 for no header, `hg:` with an empty
password, `hg:wrongpassword` and `nobody:<secret>`, and 200 only for
`hg:<secret>` and `store:<secret>`; `/v1/health` stays 200 without a credential.
- `PDRestSuiteTest` 17/17, `PDClientSuiteTest` 45/45,
`test-wait-storage.sh` 5/5, `docker/test-compose.sh render` and `mvn
editorconfig:check` on the touched PD modules all pass locally.
## Does this PR potentially affect the following parts?
- [ ] Dependencies ([add/update
license](https://hugegraph.apache.org/docs/contribution-guidelines/contribute/#321-check-licenses)
info &
[regenerate_known_dependencies.sh](../install-dist/scripts/dependency/regenerate_known_dependencies.sh))
- [x] Modify configurations
- [x] Other affects (REST clients that authenticated with a valid service
name and an arbitrary password are refused starting with this change; every
credential in this repo is updated in the same commit)
- [ ] Nope
## Documentation Status
- [ ] `Doc - TODO`
- [x] `Doc - Done`
- [ ] `Doc - No Need`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
