You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Sn0rt (via GitHub)" <gi...@apache.org> on 2023/11/06 03:19:17 UTC

[I] feat: The effective priority of clock_skew of hmac-auth [apisix]

Sn0rt opened a new issue, #10449:
URL: https://github.com/apache/apisix/issues/10449

   ### Description
   
   In actual business, we can use hmac-auth's clock_skew to prevent traffic replay attacks.
   
   However, the clock_skew attribute of hmac-auth can only be configured in consumers, and only enabled or disabled in router. This is not in line with actual business scenarios, because different business scenarios have different sensitivity to replay attacks.
   
   For example, GET /user needs to enable the hmac-auth plug-in, but this interface has relatively high clock_skew requirements, such as 10 seconds. However, although POST /order is also a sensitive interface that requires authentication and is afraid of replay attacks, hmac-auth's clock_skew Maybe 360 seconds.
   
   Now:
   
   create a consumer
   
   ```shell
   curl http://127.0.0.1:9180/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "username": "jack",
       "plugins": {
           "hmac-auth": {
               "access_key": "user-key",
               "secret_key": "my-secret-key",
               "clock_skew": 0,
               "signed_headers": ["User-Agent", "Accept-Language", "x-custom-a"]
           }
       }
   }'
   ```
   
   enable the hmac-auth with a new router
   
   ```shell
   curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "uri": "/index.html",
       "plugins": {
           "hmac-auth": {}
       },
       "upstream": {
           "type": "roundrobin",
           "nodes": {
               "127.0.0.1:1980": 1
           }
       }
   }'
   ```
   
   This will verify each customer
   
   expect:
   
   
   create a consumer
   
   ```shell
   curl http://127.0.0.1:9180/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "username": "jack",
       "plugins": {
           "hmac-auth": {
               "access_key": "user-key",
               "secret_key": "my-secret-key",
               "clock_skew": 0,
               "signed_headers": ["User-Agent", "Accept-Language", "x-custom-a"]
           }
       }
   }'
   ```
   
   enable the hmac-auth with a new router
   
   ```shell
   curl http://127.0.0.1:9180/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
   {
       "uri": "/index.html",
       "plugins": {
           "hmac-auth": {
               "clock_skew": 10,
            }
       },
       "upstream": {
           "type": "roundrobin",
           "nodes": {
               "127.0.0.1:1980": 1
           }
       }
   }'
   ```
   
   Although the clock_skew value in the consumer is 0; clock_skew is also configured in the router and the value is 10; the expected clock_skew in the router has a higher priority.
   
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] feat: The effective priority of clock_skew of hmac-auth [apisix]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #10449:
URL: https://github.com/apache/apisix/issues/10449#issuecomment-2426219010

   This issue has been marked as stale due to 350 days of inactivity. It will be closed in 2 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] feat: The effective priority of clock_skew of hmac-auth [apisix]

Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt closed issue #10449: feat: The effective priority of clock_skew of hmac-auth
URL: https://github.com/apache/apisix/issues/10449


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org