[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822959#comment-16822959 ] YaoHaishi commented on SCB-1263: PR has been created, EdgeService does not inherit InvocationContext from outer request by default. And a commit has been added to show how to inherit context by custom HttpServerFilter if users want such feature. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > Time Spent: 10m > Remaining Estimate: 0h > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822463#comment-16822463 ] YaoHaishi commented on SCB-1263: Hi, how about adding a configuration to determine whether to inherit InvocationContext? Maybe we can add a config item "servicecomb.http.dispatcher.edge.inheritInvocationContext" and its default value is false. Only if it's set to true, the EdgeService inherit x-cse-context from outside requests. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822433#comment-16822433 ] wujimin commented on SCB-1263: -- i think the difference is who do this action. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822320#comment-16822320 ] liubao commented on SCB-1263: - There is no difference between "maybe we can provide a way to allow developer inherit it manully" and "make cse-context not override by default, and add a configuration to enable it" in security concerns. So I'd prefer the second one. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822312#comment-16822312 ] wujimin commented on SCB-1263: -- this type inject is a high risk operation we should not inherit cse-context when forward request in edge automatically maybe we can provide a way to allow developer inherit it manully > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16822292#comment-16822292 ] liubao commented on SCB-1263: - Tracing is one of the possible scenarios, and you give an optional way to implement this. I still think make it possible to let users to specify cse-context header is important. Specify cse-context is not the vulnerubility, but "the set must happen after the override" is. This is very common in HTTP protocol, user's can set any internal hidden headers, the application takes it's responsibility to protect from override. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16821813#comment-16821813 ] YaoHaishi commented on SCB-1263: Agree with wujimin. Since the EdgeService is facing the request from outside, there is a high risk to allow callers outside to inject value into InvocationContext. If users want to receive InvocationContext in such situation, they can easily achieve it by extending a HttpServerFilter. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Assignee: YaoHaishi >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16821704#comment-16821704 ] wujimin commented on SCB-1263: -- for tracing from outside edge, edge should inherited them from standard http header so still no need to process cse-context? > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
[jira] [Commented] (SCB-1263) forward request in edge should not inherit cse-context
[ https://issues.apache.org/jira/browse/SCB-1263?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16821700#comment-16821700 ] liubao commented on SCB-1263: - I think we should make it default to not override, because it's very usefull for some scenarios. e.g. open tracing cross all apps. > forward request in edge should not inherit cse-context > -- > > Key: SCB-1263 > URL: https://issues.apache.org/jira/browse/SCB-1263 > Project: Apache ServiceComb > Issue Type: Task > Components: Java-Chassis >Reporter: wujimin >Priority: Major > Fix For: java-chassis-1.3.0 > > > to avoid attacker to falsify the credentials of other users -- This message was sent by Atlassian JIRA (v7.6.3#76005)
