Cluster Api security #125
Cluster Api security #125
Conversation
muralibasani
changed the title
|
|
||
| ServerConfigProperties props = new ServerConfigProperties(); | ||
| props.setKey(key); | ||
| if (key.contains("password") || key.contains("license")) { | ||
| if (key.contains("password") |
There was a problem hiding this comment.
If I'm not mistaken String.contains is case sensitive. Depending on what is returned for "key", should that be considered here?
There was a problem hiding this comment.
@reethi-kotti-aiven Yes, but it may not be considered here. All the keys are already lower case now.
There was a problem hiding this comment.
Btw, thank you for the review.
|
@muralibasani super curious, since you are using Spring Boot, why not to onboard Spring Security for JWT (https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html)? |
@reta this introduces another component 'Authorization/Resource server' to issue tokens. In this PR, trying to keep it simple. |
About this change - What it does
Connects to Klaw ClusterApi with a jwt token
getServerConfig security issue fixed. normal users should not get any server configuration
Actuator endpoints to show fewer than wildcard
Resolves:
Why this way : token based authentication is better. getServerconfig restriction based on role.