add jwt analyzer on console (close #1369) #1770

karthikvt26 · 2019-03-14T06:42:33Z

Fix #1369

Description

JWT header as below can be analyzed

Affected components

Console

Related Issues

close #1369

Solution and Design

Steps to test and verify

Create a jwt token and add a header Authorization: Bearer <token in the explorer and click on the + icon to analyze.

Limitations, known bugs & workarounds

hasura-bot · 2019-03-14T07:23:54Z

Review app for commit da8687c deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-da8687c

hasura-bot · 2019-03-14T11:22:13Z

Review app for commit 3975dda deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-3975dda

…to issue-1369

hasura-bot · 2019-03-14T12:26:45Z

Review app for commit 0401074 deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-0401074

console/src/components/ApiExplorer/Actions.js

wawhal · 2019-03-15T13:39:19Z

console/src/components/ApiExplorer/ApiRequest.js


+import jwt from 'jsonwebtoken';
+
+import Modal from 'react-bootstrap/lib/Modal';


Let us implement a common modal at the root at the app that subscribes to title, content and isOpen in redux. Then we can change these properties from anywhere and the modal becomes reusable.

Hey I am not able to wrap my head around this pattern where CommonModal can be used as

this.props.dispatch({ type: COMMON_MODAL_OPEN, title: <react-element>, content: <react-element>})

instead of

<CommonModal title={ title }> <Body> </CommonModal>

The body can be as complicated as it can. @wawhal Let me know what you think.

wawhal

Code looks fine.
We can make the reusable moddal and we're good to go.

hasura-bot · 2019-03-15T16:57:47Z

Review app for commit 0aa6b52 deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-0aa6b52

coco98 · 2019-03-19T06:27:45Z

I think it would be important to highlight a few things in the JWT analyser to make this useful:

Show me if Hasura has been setup to verify this signature. If hasura has not been setup then prompt me to setup Hasura and link to the docs so that I can.
Highlight the Hasura claims (once hasura jwt config is setup you'll know which claims are the right claims to look at). Further tell me if Hasura specific claims are missing. allowed-roles and default-role are mandatory.

Without these 2 things this is not useful. Also, the + icon should be an i(information) or ?(help) icon right?
@rikinsk

coco98 · 2019-03-19T06:29:01Z

Also, set tabwidth to 2 spaces? It looks like it's 8 right now.

netlify · 2019-03-20T06:55:05Z

Deploy preview for hasura-docs ready!

Built with commit af93aea

https://deploy-preview-1770--hasura-docs.netlify.com

hasura-bot · 2019-03-20T09:02:10Z

Review app for commit 7a98d0a deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-7a98d0a

karthikvt26 · 2019-03-20T13:24:03Z

It is possible for me to achieve both. But not in a straight forward way. I have mentioned them below.

Show me if Hasura has been setup to verify this signature. If hasura has not been setup then prompt me to setup Hasura and link to the docs so that I can.

I will make introspection query without the Authorization header and parse the response to come to the conclusion.

Highlight the Hasura claims (once hasura jwt config is setup you'll know which claims are the right claims to look at). Further tell me if Hasura specific claims are missing. allowed-roles and default-role are mandatory.

I can parse the payload to find out x-hasura-* inside the object to get the relevant header. I can highlight and show it to the user.

The above issues will become straight forward if for 1, the server hydrates a flag isJWTSet it will be useful. For the second scenario, if it can provide the claims_namespace then it will become straight forward to implement it.

@coco98 @rikinsk
Let me know what you think?

coco98 · 2019-03-20T16:21:38Z

Why can’t the server template the entire jwt config for the console?

That way you have everything.

karthikvt26 · 2019-03-20T16:47:37Z

I think the problem is with the authentication. Server will not know whether the user is authenticated or not on page load before the user is asked to login. The jwt stuff should be there in env only for authenticated requests. @wawhal thoughts?

…

On Wed, 20 Mar 2019 at 9:51 PM, Tanmai Gopal ***@***.***> wrote: Why can’t the server template the entire jwt config for the console? That way you have everything. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1770 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AX7uzCtQwfg44l1rwhaQtqezeRhUKYSzks5vYmAZgaJpZM4bzamR> .

ecthiender · 2019-03-20T18:17:21Z

The server can template `is_jwt_set` and `claims_namespace`. Console does not need the exact key anyway. On Wed, Mar 20, 2019 at 10:17 PM Karthik Venkateswaran < notifications@github.com> wrote:

…

I think the problem is with the authentication. Server will not know whether the user is authenticated or not on page load before the user is asked to login. The jwt stuff should be there in env only for authenticated requests. @wawhal thoughts? On Wed, 20 Mar 2019 at 9:51 PM, Tanmai Gopal ***@***.***> wrote: > Why can’t the server template the entire jwt config for the console? > > That way you have everything. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > < #1770 (comment) >, > or mute the thread > < https://github.com/notifications/unsubscribe-auth/AX7uzCtQwfg44l1rwhaQtqezeRhUKYSzks5vYmAZgaJpZM4bzamR > > . > — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#1770 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAlnwyq6s5qYoOHlTBan1B_g_M1_SdZiks5vYmYrgaJpZM4bzamR> .

coco98 · 2019-03-20T18:22:36Z

But having key is good so that console can tell you if the jwt is valid per Hasura. Otherwise capturing feedback about invalid jwt key only happens via logs :(

…

On Wed, Mar 20, 2019 at 2:17 PM, Anon Ray ***@***.***> wrote: The server can template `is_jwt_set` and `claims_namespace`. Console does not need the exact key anyway. On Wed, Mar 20, 2019 at 10:17 PM Karthik Venkateswaran < ***@***.***> wrote: > I think the problem is with the authentication. Server will not know > whether the user is authenticated or not on page load before the user is > asked to login. > > The jwt stuff should be there in env only for authenticated requests. > > @wawhal thoughts? > > On Wed, 20 Mar 2019 at 9:51 PM, Tanmai Gopal ***@***.***> > wrote: > > > Why can’t the server template the entire jwt config for the console? > > > > That way you have everything. > > > > — > > You are receiving this because you authored the thread. > > Reply to this email directly, view it on GitHub > > < > #1770 (comment) > >, > > or mute the thread > > < > https://github.com/notifications/unsubscribe-auth/AX7uzCtQwfg44l1rwhaQtqezeRhUKYSzks5vYmAZgaJpZM4bzamR > > > > . > > > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > < #1770 (comment) >, > or mute the thread > < https://github.com/notifications/unsubscribe-auth/AAlnwyq6s5qYoOHlTBan1B_g_M1_SdZiks5vYmYrgaJpZM4bzamR > > . > — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1770 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAIAWI-uK0oj0F80cB4zBMGQY2DJGs47ks5vYnsxgaJpZM4bzamR> .

ecthiender · 2019-03-21T07:42:58Z

But having key is good so that console can tell you if the jwt is valid per Hasura. Otherwise capturing feedback about invalid jwt key only happens via logs :(

For invalid jwt, the response from server has invalid-jwt as a code with a reason message.

But in any case, the key can't be templated on the console html, because then anyone can grab the jwt secret. Server can provide a separate admin only endpoint to dump the config. Does that make sense @coco98 ?

ecthiender · 2019-03-28T06:32:14Z

According to the latest discussion with @dsandip and @rikinsk we are doing the following:
cc @karthikvt26

Server

Server will not dump the entire jwt config to the console. It will have an endpoint which will return is_jwt_set, claims_namespace and claims_format. (should this endpoint be available only on dev-mode?)
Server will need to improve current error messages when JWT is invalid. And also return more details in the reponse, when the verbose-api response flag is enabled.

Console

Console need not replicate the entire logic for verifying the JWT (because the jwt config can also contain jwk url not just the key, the verification becomes more complex). It can hit the server to verify the JWT and display the error messages returned by the server.
Console needs to use the claims_namespace and claims_format to highlight the hasura claims correctly.

Please add if I missed anything.

hasura-bot · 2019-04-04T12:54:43Z

Review app for commit 731ef1b deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-731ef1b

hasura-bot · 2019-04-05T07:56:36Z

Review app for commit bdf228c deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-bdf228c

hasura-bot · 2019-04-05T09:47:13Z

Review app for commit 952003c deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-952003c

… after

hasura-bot · 2019-04-05T11:09:28Z

Review app for commit af93aea deployed to Heroku: https://hge-ci-pull-1770.herokuapp.com
Docker image for server: hasura/graphql-engine:pull1770-af93aea

shahidhk · 2019-06-03T09:22:09Z

closed in favour of #1925

hasura-bot · 2019-06-03T09:22:11Z

Review app https://hge-ci-pull-1770.herokuapp.com is deleted

… expression types (#1770)  ### What Introduces stricter validation for scalar boolean expression operators during the build process. This change helps catch invalid operator usage early by validating: - List type requirements for `_in` operator - Type matching for comparison operators (`_eq`, `_lt`, `_lte`, `_gt`, `_gte`) - Operator existence in data connector - Argument type compatibility with NDC operator types - Operators like `contains`, `icontains`, `starts_with` and `ends_with` etc. must be applicable to string scalar and argument type must be a string. These validations are controlled by a compatibility flag, issuing warnings for existing projects while enforcing strict errors for new projects created after or with a compatibility date set beyond the release date of this fix. ### How - Added new compatibility flag `ValidateScalarBooleanExpressionOperators` - Implemented validation checks in the build process to verify operator usage - Updated changelog with the new validations - Fix existing tests' metadata to avoid new warnings  V3_GIT_ORIGIN_REV_ID: d468a6794af68d06a4a8fae3f8f1023c7824bdfb

Add jwt analyzer

da8687c

karthikvt26 requested a review from rikinsk-zz as a code owner March 14, 2019 06:42

karthikvt26 changed the title ~~Add jwt bearer tokens analyzer in Explorer~~ Add jwt bearer token analyzer in Explorer Mar 14, 2019

Merge branch 'master' into issue-1369

3975dda

karthikvt26 added 2 commits March 14, 2019 17:08

Fix typo

adef637

Merge branch 'issue-1369' of github.com:karthikvt26/graphql-engine in…

0401074

…to issue-1369

shahidhk added the c/console Related to console label Mar 15, 2019

shahidhk changed the title ~~Add jwt bearer token analyzer in Explorer~~ add jwt analyzer on console (close #1369) Mar 15, 2019

karthikvt26 requested a review from wawhal March 15, 2019 11:01

wawhal reviewed Mar 15, 2019

View reviewed changes

console/src/components/ApiExplorer/Actions.js Outdated Show resolved Hide resolved

wawhal reviewed Mar 15, 2019

View reviewed changes

wawhal suggested changes Mar 15, 2019

View reviewed changes

Fixes suggested by wawhal

0aa6b52

Fix indent

7a98d0a

ecthiender mentioned this pull request Mar 21, 2019

admin only endpoint to dump configuration settings #1831

Closed

shahidhk added the s/do-not-merge Do not merge this pull request to master label Mar 27, 2019

shahidhk added the s/wip Status: This issue is a work in progress label Mar 27, 2019

shahidhk mentioned this pull request Apr 2, 2019

add a new api to get config details (close #1831); add jwt-analyzer (close #1369) #1925

Merged

5 tasks

karthikvt26 added 3 commits April 3, 2019 16:46

Merge remote-tracking branch 'main/master' into issue-1369

ee6df56

Add onAnalyzeBearerClose back

1b02503

Integrate with server API

731ef1b

Change key claim_namespace to claims_namespace

bdf228c

Fix test

952003c

Show jwt error message below status and move namespace parsing result…

af93aea

… after

dsandip added this to the release-candidates milestone Apr 15, 2019

shahidhk closed this Jun 3, 2019


		import jwt from 'jsonwebtoken';

		import Modal from 'react-bootstrap/lib/Modal';

add jwt analyzer on console (close #1369) #1770

add jwt analyzer on console (close #1369) #1770

Uh oh!

Conversation

karthikvt26 commented Mar 14, 2019

Description

Affected components

Related Issues

Solution and Design

Steps to test and verify

Limitations, known bugs & workarounds

Uh oh!

hasura-bot commented Mar 14, 2019

Uh oh!

hasura-bot commented Mar 14, 2019

Uh oh!

hasura-bot commented Mar 14, 2019

Uh oh!

Uh oh!

wawhal Mar 15, 2019

Choose a reason for hiding this comment

Uh oh!

karthikvt26 Mar 15, 2019

Choose a reason for hiding this comment

Uh oh!

wawhal left a comment

Choose a reason for hiding this comment

Uh oh!

hasura-bot commented Mar 15, 2019

Uh oh!

coco98 commented Mar 19, 2019

Uh oh!

coco98 commented Mar 19, 2019

Uh oh!

netlify bot commented Mar 20, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hasura-bot commented Mar 20, 2019

Uh oh!

karthikvt26 commented Mar 20, 2019

Uh oh!

coco98 commented Mar 20, 2019

Uh oh!

karthikvt26 commented Mar 20, 2019 via email

Uh oh!

ecthiender commented Mar 20, 2019 via email

Uh oh!

coco98 commented Mar 20, 2019 via email

Uh oh!

ecthiender commented Mar 21, 2019

Uh oh!

ecthiender commented Mar 28, 2019

Server

Console

Uh oh!

hasura-bot commented Apr 4, 2019

Uh oh!

hasura-bot commented Apr 5, 2019

Uh oh!

hasura-bot commented Apr 5, 2019

Uh oh!

hasura-bot commented Apr 5, 2019

Uh oh!

shahidhk commented Jun 3, 2019

Uh oh!

hasura-bot commented Jun 3, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

netlify bot commented Mar 20, 2019 •

edited

Loading