You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "huibertalblas (via GitHub)" <gi...@apache.org> on 2025/07/25 12:30:58 UTC
[PR] [feature][websocket] Enforce access token expiration [pulsar]
huibertalblas opened a new pull request, #24563:
URL: https://github.com/apache/pulsar/pull/24563
<!--
### Contribution Checklist
- PR title format should be *[type][component] summary*. For details, see *[Guideline - Pulsar PR Naming Convention](https://pulsar.apache.org/contribute/develop-semantic-title/)*.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message
- Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below.
-->
<!-- Either this PR fixes an issue, -->
Fixes that the expiration time of an access token is ignored for Websocket connections.
<!-- or this PR is one task of an issue -->
<!-- Main Issue: #xyz -->
<!-- If the PR belongs to a PIP, please add the PIP link here -->
PIP: [292](https://github.com/apache/pulsar/blob/master/pip/pip-292.md)
<!-- Details of when a PIP is required and how the PIP process work, please see: https://github.com/apache/pulsar/blob/master/pip/README.md -->
### Motivation
<!-- Explain here the context, and why you're making that change. What is the problem you're trying to solve. -->
When a client connects via Websockets and uses a token as authentication mechanism, the validity of the token is only checked when the connection is established. When the expiry time of the token has passed, the client remains connected.
This is insecure, and makes the websocket implementation unsuitable for a use case where the enforcement of the token expiry time is important.
### Modifications
<!-- Describe the modifications you've done. -->
From a user perspective, a few changes are noticable:
- In the server configuration the value "authenticationRefreshCheckSeconds" can be set to specify the interval with which to check if the supplied access token has expired. By default it is disabled (-1).
- A websocket client can now receive a notification message indicating that the used access token is about to expire, and should be updated (AUTH_CHALLENGE).
- A websocket client can now send a new access token over the existing websocket connection to keep the session active. (AUTH_RESPONSE).
The core code modification is made in AbstractWebSocketHandler.java
- Here the periodic check of the exiration of the AuthMethod is implemented under 'onWebSocketConnect()'. (Inspired by [this](https://github.com/Topsector-Logistiek/Apache-Pulsar/blob/b58e99b003262dcb13c207e413570facb3dba459/pulsar-broker/src/main/java/org/apache/pulsar/broker/service/ServerCnx.java#L991))
- The function "checkAuth()" has been split up into "checkAuthentication()" and "checkAuthorization()". The content of the function has remained mostly the same.
Modifications for requesting and receiving a new access token from the client:
- "PulsarWebsocketDecoder.java" has been added in order to centralise the message handling (Originally in ReaderHandler, ProducerHandler & ConsumerHandler).
- Classes under "java/org/apache/pulsar/websocket/data/..." are added to be able to sent and receive ("AUTH_CHALLENGE" & "AUTH_RESPONSE") messages.
A function in AuthenticationService.java has been added to query the configured authentication providers to keep the support for multiple authentication providers.
### Verifying this change
- [x] Make sure that the change passes the CI checks.
<!-- *(Please pick either of the following options)*
This change is a trivial rework / code cleanup without any test coverage.
*(or)*
This change is already covered by existing tests, such as *(please describe tests)*.
*(or)* -->
This change added tests and can be verified as follows:
- Added unit test for the PulsarWebsocketDecoder to check if incomming messages get parsed correctly.
- Added integration check to check if the connection is dropped after the expiration time in the access token has expired.
### Does this pull request potentially affect one of the following parts:
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
*If the box was checked, please highlight the changes*
- [ ] Dependencies (add or upgrade a dependency)
- [ ] The public API
- [ ] The schema
- [ ] The default values of configurations
- [ ] The threading model
- [ ] The binary protocol
- [ ] The REST endpoints
- [ ] The admin CLI options
- [ ] The metrics
- [ ] Anything that affects deployment
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [x] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [ ] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
### Matching PR in forked repository
PR in forked repository: https://github.com/Topsector-Logistiek/Apache-Pulsar/pull/2
<!--
After opening this PR, the build in apache/pulsar will fail and instructions will
be provided for opening a PR in the PR author's forked repository.
apache/pulsar pull requests should be first tested in your own fork since the
apache/pulsar CI based on GitHub Actions has constrained resources and quota.
GitHub Actions provides separate quota for pull requests that are executed in
a forked repository.
The tests will be run in the forked repository until all PR review comments have
been handled, the tests pass and the PR is approved by a reviewer.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [feature][websocket] Enforce access token expiration [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat commented on PR #24563:
URL: https://github.com/apache/pulsar/pull/24563#issuecomment-6348098608
Thanks for working on this, and sorry it waited so long for a review. I'm closing it for now because, as it stands, it would change behavior for existing WebSocket clients:
- When the WebSocket service runs inside the broker, it reads the broker's `authenticationRefreshCheckSeconds` (default 60), so the check would be on by default there, and existing clients have no way to answer `AUTH_CHALLENGE`.
- Moving message parsing into `PulsarWebsocketDecoder` changes error handling: invalid producer JSON no longer gets a `FailedToDeserializeFromJSON` ack, and invalid consumer commands no longer close the session.
master has also moved a lot since (Jetty 12, slog, `websocket/data` now in `pulsar-common`), so a rebase would be close to a rewrite. A future version would need an explicit WebSocket-side opt-in (off by default), documented `AUTH_CHALLENGE`/`AUTH_RESPONSE` messages, and the existing message handling left unchanged. You're very welcome to reopen or start a new PR along those lines.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [feature][websocket] Enforce access token expiration [pulsar]
Posted by "merlimat (via GitHub)" <gi...@apache.org>.
merlimat closed pull request #24563: [feature][websocket] Enforce access token expiration
URL: https://github.com/apache/pulsar/pull/24563
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [feature][websocket] Enforce access token expiration [pulsar]
Posted by "huibertalblas (via GitHub)" <gi...@apache.org>.
huibertalblas commented on PR #24563:
URL: https://github.com/apache/pulsar/pull/24563#issuecomment-3138566940
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org