861343 - [MakeAPI] Implement API security model

Status: RESOLVED FIXED

(Webmaker Graveyard :: MakeAPI, defect)

Description

[Chris DeCairos (:cade)]

Certain actions will require authentication.

Comment 1

[Chris DeCairos (:cade)]

Gonna write some things in my head down:

Create, update, delete: limit to authenticated webmakers. requests for new makes must originate from one of our domains (thimble.wm.org, popcorn.wm.org, etc)

I'm not sure how limited we want searching to be. But if we're keeping it to webmaker tools, then requests must originate from our domains.

Comment 2

[Chris DeCairos (:cade)]

Attachment: Fix Routes, make Search us GET

https://github.com/mozilla/MakeAPI/pull/13

Comment 3

[Chris DeCairos (:cade)]

Comment on attachment 739216 [details] [review]
Fix Routes, make Search us GET

gah, wrong bug.

Comment 4

[Chris DeCairos (:cade)]

There have been a few ideas thrown around for this.

The first is a separation into two apps. the first would sit behind a firewall and only be accessible from our apps. It will be able to do create/update/delete on the assumption that our apps have an authenticated user triggering the actions. The second app would be a public facing search endpoint that doesn't require authentication to query.

In talking with :sedge we threw around some ideas where the SSO app could generate tokens or API keys for logged in users to use with the API for create/update/delete. The only useful reason to have that is for admins to be able to log in using a web interface that's not backed by a node app and can make authenticated calls.

thoughts?

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Need info flag without the person from whom you need info isn't gonna get you anywhere, sadly :) You can tag multiple people with a comma separated list.

Any further update / discussion here?

Comment 6

[Jon Buckley]

I spoke with some of the webdev team members, and we thought that adding basic authentication would be the easiest method. You could configure a list of accepted username/password pairs on the MakeAPI side, then hand out these credentials for each server that needed priveleged write access to the MakeAPI.

Comment 7

[Chris DeCairos (:cade)]

(In reply to Jon Buckley [:jbuck] from comment #6)
> I spoke with some of the webdev team members, and we thought that adding
> basic authentication would be the easiest method. You could configure a list
> of accepted username/password pairs on the MakeAPI side, then hand out these
> credentials for each server that needed priveleged write access to the
> MakeAPI.

That seems like a workable approach. Might be a bit of a pain handing out credentials to the authorized applications though.

Comment 8

[Chris DeCairos (:cade)]

Attachment: https://github.com/mozilla/MakeAPI/pull/25

Adds basic Auth for the Create/Update/Delete routes. 

User/pass values are set up by env variables at run time. (see env.sample)

Comment 9

[Kieran Sedgwick (:sedge)]

:jbuck - It seems I'm late to the game on this one, but doens't having basic authentication for the MakeAPI reduce the impact of a single-sign on?

Comment 10

[Chris DeCairos (:cade)]

(In reply to Kieran Sedgwick (:sedge) from comment #9)
> :jbuck - It seems I'm late to the game on this one, but doens't having basic
> authentication for the MakeAPI reduce the impact of a single-sign on?

It shouldn't, C/U/D endpoint should only be used behind the scenes by our apps anyways, and searching can be completely public.

Comment 11

[Jon Buckley]

Comment on attachment 740469 [details] [review]
https://github.com/mozilla/MakeAPI/pull/25

There's two ways this could be done, you could either have one set of routes for Persona-authenticated users and one for basic authenticated servers or you could just assume that all updates to the makeAPI will be done through servers.

I'm okay with picking the latter for now, and supporting the Persona-authenticated route in the future.

r-, problems noted in the pull request.

Comment 12

[Chris DeCairos (:cade)]

(In reply to Jon Buckley [:jbuck] from comment #11)
> There's two ways this could be done, you could either have one set of routes
> for Persona-authenticated users and one for basic authenticated servers or
> you could just assume that all updates to the makeAPI will be done through
> servers.

I'm still curious what kind of system we could use to authenticate logged webmaker accounts.

Comment 13

[Chris DeCairos (:cade)]

Comment on attachment 740469 [details] [review]
https://github.com/mozilla/MakeAPI/pull/25

I've addressed all of your concerns.

Comment 14

[Jon Buckley]

Comment on attachment 740469 [details] [review]
https://github.com/mozilla/MakeAPI/pull/25

R+

Comment 15

[Chris DeCairos (:cade)]

Staged on Master: https://github.com/mozilla/MakeAPI/commit/5e9f2912e8481cc04f3638b1a3c9bb7e4968795f