Add JWT token authentication to Mailroom gem's postback delivery strategy
Although mail_room supports postback delivery method, the only authentication configuration is to use a token header. Internally, mail_room gem uses Faraday and its token_auth authentication method. This method adds a configured token to Authorization header: Authorization: Token token="something"
. This authentication header seems not to be suitable for GitLab source code. As the webhook API (#1457 (closed)) we intended to implement is an internal API, we can follow or re-use the authentication implementation of other similar internal APIs.
-
gitlab-shell compares the token fetched from request's
Gitlab-Shared-Secret
header with a configured secret token. -
Gitlab pages decodes the JWT token fetched from request's
Gitlab-Pages-Api-Request
header. -
Gitlab KAS decodes the JWT token fetched from request's
Gitlab-Kas-Api-Request
header.
The JWT token seems to be a decent solution. The new JWT configuration looks something like:
:email: "user8@gmail.com"
:password: "password"
:name: "inbox"
:delivery_method: postback
:delivery_options:
:delivery_url: "http://localhost:3000/inbox"
:jwt_auth_header: "Gitlab-Mailroom-Api-Request"
:jwt_issuer: "gitlab-mailroom"
:jwt_algorithm: "HS256"
:jwt_secret_path: "/etc/gitlab-secrets/mailroom/.gitlab_mailroom_secret"
Edited by Quang-Minh Nguyen