relay-proxy: Support API Keys validation to limit the applications being able to use GO Feature Flag #649

dhanusaputra · 2023-03-30T12:01:46Z

Description

The feature should meet the following requirements:

The relay proxy should be modified to support a list of authorized API keys in the configuration.

will use APIKeys to initiate list of keys

The authorized API keys list should be configurable.

configurable in goff.yaml

The relay proxy should check the API keys in the Authorization header when receiving any requests and only allow requests with valid API keys.

use middleware.KeyAuthWithConfig to check the header with format: Bearer <key>

Unauthorized requests should be rejected with an appropriate error message.

middleware.KeyAuthWithConfig.Validator will reject unauthorized requests

The feature should not significantly impact the performance of the relay proxy.

basically will add one more process in middleware to check the header

Changes include

Bugfix (non-breaking change that solves an issue)
New feature (non-breaking change that adds functionality)
Breaking changes (change that is not backward-compatible and/or changes current functionality)

Closes issue(s)

Resolve #613

Checklist

I have tested this code
I have added unit test to cover this code
I have updated the documentation (README.md and /website/docs)
I have followed the contributing guide

netlify · 2023-03-30T12:01:53Z

✅ Deploy Preview for go-feature-flag-doc-preview canceled.

Name	Link
🔨 Latest commit	`99a39b4`
🔍 Latest deploy log	https://app.netlify.com/sites/go-feature-flag-doc-preview/deploys/642c1c165e5cb30008330f97

codecov · 2023-03-30T12:06:35Z

Codecov Report

Merging #649 (99a39b4) into main (34d24f6) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #649   +/-   ##
=======================================
  Coverage   88.40%   88.40%           
=======================================
  Files          58       58           
  Lines        2605     2605           
=======================================
  Hits         2303     2303           
  Misses        252      252           
  Partials       50       50

Impacted Files	Coverage Δ
cmd/relayproxy/config/config.go	`95.31% <ø> (ø)`
cmd/relayproxy/controller/all_flags.go	`85.71% <ø> (ø)`
cmd/relayproxy/controller/collect_eval_data.go	`100.00% <ø> (ø)`
cmd/relayproxy/controller/flag_eval.go	`88.00% <ø> (ø)`
cmd/relayproxy/main.go	`0.00% <ø> (ø)`

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

dhanusaputra · 2023-03-30T12:09:22Z

hi @thomaspoignant just drafted this PR for initial feedback
please help take a look when have time thank you

please also check the controller part cmd/relayproxy/controller/api_key.go
it's still WIP, have put some comments regarding the API contract flow

one more thing, currently we can put user in request body of some endpoints to know who is the requester
maybe we can use the user data when we create API key?

thomaspoignant

Hey thanks for this PR.

I am not sure to understand how you proposal will work.
How can I add an API key? By calling the API and it will be stored in memory?
How will it work when the relay-proxy will restart, will we lose the API keys configured?

How I was thinking of doing this, was to have a list of API keys in the relay proxy configuration file and I would have challenged the authorization headers with everything that is part of this list.

dhanusaputra · 2023-04-01T13:04:12Z

How can I add an API key?

using the apiKeyCreate endpoint

By calling the API and it will be stored in memory?

yes

How will it work when the relay-proxy will restart, will we lose the API keys configured?

yes everything will be lost

How I was thinking of doing this, was to have a list of API keys in the relay proxy configuration file and I would have challenged the authorization headers with everything that is part of this list.

got it, let me rework the PR, I'm more aligned this way too, thank you for your feedback!

…ing able to use GO Feature Flag

…ing able to use GO Feature Flag, rework by feedback

…ing able to use GO Feature Flag, simplify

…ing able to use GO Feature Flag, update docs

…ing able to use GO Feature Flag, update swagger

dhanusaputra · 2023-04-02T09:59:48Z

cmd/relayproxy/README.md

@@ -47,7 +47,7 @@ Before starting your **relay proxy** you will need to create a minimal configura
 # this is a minimal config containing only where your flag file is located 
 retriever:
  kind: http
-  url: https://raw.githubusercontent.com/thomaspoignant/go-feature-flag/main/examples/file/flags.yaml


invalid url

Good catch 👍

…ing able to use GO Feature Flag, gen swagger

thomaspoignant

This approach is way closer to what I had in mind thank you 🙏
I've added a few review point because I am not sure to get all the points here.

thomaspoignant · 2023-04-03T16:12:14Z

cmd/relayproxy/config/config.go

@@ -137,6 +138,9 @@ type Config struct {

 	// Version is the version of the relay-proxy
 	Version string
+
+	// APIKeys list of API keys that authorized to use endpoints
+	APIKeys map[string]bool `mapstructure:"apiKeys"`


I am not sure to understand why you have a map[string]bool, is it to have a set here?
If so we may need to consider having a map[string]interface{} instead since it is a bit better in term of memory and size.

See https://itnext.io/set-in-go-map-bool-and-map-struct-performance-comparison-5315b4b107b

thanks for the article, TIL
let me change it into slice since it's more easy to understand in config

thomaspoignant · 2023-04-03T16:13:29Z

cmd/relayproxy/testdata/config/valid-file.yaml

+apiKeys:
+  apikey1: true
+  apikey2: true


I am not sure to understand the boolean here.
Would it be better to have only a list, something like

apiKeys: - apikey1 # with a comment explaining who is the owner of the key - apikey2

I think it will make the configuration representation way easier to understand.
You can still put it in a set in the config struct, but in terms of configuration, it will be way more understandable for the users of the relay proxy.

thomaspoignant · 2023-04-03T16:14:32Z

website/docs/relay_proxy/configure_relay_proxy.md

@@ -31,6 +31,7 @@ If you want to replace a nested fields, please use `_` to separate each field _(
 | `startWithRetrieverError` | boolean                   | `false`     | By default the **relay proxy** will crash if he is not able to retrieve the flags from the configuration.<br/>If you don't want your relay proxy to crash, you can set `startWithRetrieverError` to true. Until the flag is retrievable the relay proxy will only answer with default values. |
 | `exporter`                | [exporter](#exporter)     | **none**    | Exporter is the configuration on how to export data.                                                                                                                                                                                                                                          |
 | `notifier`                | [notifier](#notifier)     | **none**    | Notifiers is the configuration on where to notify a flag change.                                                                                                                                                                                                                              |
+| `apiKeys` | map[string]bool | **none** | List of authorized API keys. Each request will need to provide one of authorized key inside `Authorization` header with format `Bearer <api-key>`. There will be no authorization when this config is not configured.<br /><br />_Note: there will be no authorization when this config is not set._ |


You mention twice this, maybe we should remove one.

There will be no authorization when this config is not configured.

these 2 docs looks similar
https://github.com/thomaspoignant/go-feature-flag/blob/HEAD/cmd/relayproxy/docs/configuration.md
https://github.com/thomaspoignant/go-feature-flag/blob/main/website/docs/relay_proxy/configure_relay_proxy.md
maybe can just keep one

You are right.
I guess we could delete the one in cmd/relayproxy/docs since it is not really used and keep only the one that finish on the website.

…ing able to use GO Feature Flag, fix review

thomaspoignant

This looks exactly to what I had in mind.
I will review it soon.

Signed-off-by: Thomas Poignant <[email protected]>

sonarcloud · 2023-04-04T12:46:50Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

thomaspoignant

@dhanusaputra thanks a lot for this pull request this is a super great new addition to GO Feature Flag 🙏

github-actions bot assigned thomaspoignant Mar 30, 2023

github-actions bot requested a review from thomaspoignant March 30, 2023 12:02

dhanusaputra marked this pull request as draft March 30, 2023 12:09

thomaspoignant reviewed Mar 31, 2023

View reviewed changes

dhanusaputra added 2 commits April 2, 2023 13:43

relay-proxy: Support API Keys validation to limit the applications be…

19cdfc6

…ing able to use GO Feature Flag

relay-proxy: Support API Keys validation to limit the applications be…

bcab9a7

…ing able to use GO Feature Flag, rework by feedback

dhanusaputra force-pushed the api-keys-validation branch from b782d3a to bcab9a7 Compare April 2, 2023 08:32

dhanusaputra added 4 commits April 2, 2023 15:54

relay-proxy: Support API Keys validation to limit the applications be…

e793663

…ing able to use GO Feature Flag, simplify

relay-proxy: Support API Keys validation to limit the applications be…

571ef12

…ing able to use GO Feature Flag, update docs

relay-proxy: Support API Keys validation to limit the applications be…

f8f14a5

…ing able to use GO Feature Flag, update docs

relay-proxy: Support API Keys validation to limit the applications be…

a9c1167

…ing able to use GO Feature Flag, update swagger

dhanusaputra commented Apr 2, 2023

View reviewed changes

dhanusaputra marked this pull request as ready for review April 2, 2023 10:00

relay-proxy: Support API Keys validation to limit the applications be…

2b9e5ce

…ing able to use GO Feature Flag, gen swagger

thomaspoignant requested changes Apr 3, 2023

View reviewed changes

relay-proxy: Support API Keys validation to limit the applications be…

d3eb19c

…ing able to use GO Feature Flag, fix review

thomaspoignant reviewed Apr 4, 2023

View reviewed changes

thomaspoignant added 2 commits April 4, 2023 11:15

Merge branch 'main' into api-keys-validation

5528a3d

Remove duplicate docs

99a39b4

Signed-off-by: Thomas Poignant <[email protected]>

thomaspoignant approved these changes Apr 4, 2023

View reviewed changes

thomaspoignant merged commit a50b08f into thomaspoignant:main Apr 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

relay-proxy: Support API Keys validation to limit the applications being able to use GO Feature Flag #649

relay-proxy: Support API Keys validation to limit the applications being able to use GO Feature Flag #649

dhanusaputra commented Mar 30, 2023 •

edited

Loading

netlify bot commented Mar 30, 2023 •

edited

Loading

codecov bot commented Mar 30, 2023 •

edited

Loading

dhanusaputra commented Mar 30, 2023

thomaspoignant left a comment •

edited

Loading

dhanusaputra commented Apr 1, 2023

dhanusaputra Apr 2, 2023

thomaspoignant Apr 3, 2023

thomaspoignant left a comment

thomaspoignant Apr 3, 2023 •

edited

Loading

dhanusaputra Apr 4, 2023

thomaspoignant Apr 3, 2023

thomaspoignant Apr 3, 2023

dhanusaputra Apr 4, 2023

thomaspoignant Apr 4, 2023

thomaspoignant left a comment

sonarcloud bot commented Apr 4, 2023

thomaspoignant left a comment

relay-proxy: Support API Keys validation to limit the applications being able to use GO Feature Flag #649

relay-proxy: Support API Keys validation to limit the applications being able to use GO Feature Flag #649

Conversation

dhanusaputra commented Mar 30, 2023 • edited Loading

Description

Changes include

Closes issue(s)

Checklist

netlify bot commented Mar 30, 2023 • edited Loading

✅ Deploy Preview for go-feature-flag-doc-preview canceled.

codecov bot commented Mar 30, 2023 • edited Loading

Codecov Report

dhanusaputra commented Mar 30, 2023

thomaspoignant left a comment • edited Loading

Choose a reason for hiding this comment

dhanusaputra commented Apr 1, 2023

dhanusaputra Apr 2, 2023

Choose a reason for hiding this comment

thomaspoignant Apr 3, 2023

Choose a reason for hiding this comment

thomaspoignant left a comment

Choose a reason for hiding this comment

thomaspoignant Apr 3, 2023 • edited Loading

Choose a reason for hiding this comment

dhanusaputra Apr 4, 2023

Choose a reason for hiding this comment

thomaspoignant Apr 3, 2023

Choose a reason for hiding this comment

thomaspoignant Apr 3, 2023

Choose a reason for hiding this comment

dhanusaputra Apr 4, 2023

Choose a reason for hiding this comment

thomaspoignant Apr 4, 2023

Choose a reason for hiding this comment

thomaspoignant left a comment

Choose a reason for hiding this comment

sonarcloud bot commented Apr 4, 2023

thomaspoignant left a comment

Choose a reason for hiding this comment

dhanusaputra commented Mar 30, 2023 •

edited

Loading

netlify bot commented Mar 30, 2023 •

edited

Loading

codecov bot commented Mar 30, 2023 •

edited

Loading

thomaspoignant left a comment •

edited

Loading

thomaspoignant Apr 3, 2023 •

edited

Loading