Skip to content

Draft: Add DPoP checks in GraphQL and API requests

Ameya Darshan requested to merge ameya-dpop-2 into ameya-dpop-1

What does this MR do and why?

See Sender constraining personal access tokens (#425130) for more context. This MR makes use of the backend DPoP checks that are introduced in Parse and validate DPoP Tokens (!166206).

TODO

  • @nmalcolm has been asked to add "testing and adding a couple of specs. We also need to add the feature flag checks"

How to set up and validate locally

  1. In rails console, enable the feature flag for the user you are going to be testing the feature with:
Feature.enable(:dpop_authentication, User.find(1)
  1. Using the rails console, enable DPoP for the user :
UserPreferences::UpdateService.new(User.find(1), {dpop_enabled: true}).execute
  1. Ensure you have an SSH key-pair setup with the public key uploaded to your user account. Ensure that the key type is saved as "Signing" or "Authentication and Signing".
  2. Build glab from this branch.
  3. Using glab generate a DPoP header: bin/glab auth dpop-gen --pat "glpat-PAT" --private-key ~.ssh/id_rsa
  4. Use the generated header to make an HTTP API request: curl http://localhost:3000/api/v4/projects --header "Private-Token: glpat-PAT" --header "DPoP: <GLAB OUTPUT HERE>"
  5. Confirm valid response is received. Confirm that the request fails without a valid DPoP header.
  6. Confirm that the server responds with accurate error messages related to the failing DPoP check (eg. signature expired, JWT invalid, etc.). You can find a list of these checks in this file.
Edited by Nick Malcolm

Merge request reports