Security authn via netty channel validator #95112
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
…uthn-with-header-validator
albertzaharovits force-pushed the security-early-authn-with-header-validator branch from 979b40a to 322f4e9 Compare albertzaharovits added the :Security/Authentication albertzaharovits added a commit that referenced this pull request May 8, 2023
This PR tests that malformed HTTP requests that fail at the decoding stage don't go through validation and are further dispatched as bad requests. Related: #95112
This was referenced May 9, 2023
albertzaharovits added a commit that referenced this pull request May 12, 2023
albertzaharovits added a commit that referenced this pull request May 18, 2023
Following the changes in #95112, which relocated the calls into the AuthenticationService that authenticate HTTP requests, the authentication duration was no longer comprised in between the Tracer#startTrace and Tracer#stopTrace. Consequently, the span records didn't cover the authentication duration any longer. This PR remedies that by changing the Tracer implementation, i.e. APMTracer, to look for the trace start time instant in the transient thread context and use that when starting traces (overriding the now default). The trace start time is set in the thread context when the request-wise thread context is first populated (with HTTP request headers).
albertzaharovits added a commit that referenced this pull request May 29, 2023
Instead of not authN and letting them through, this PR rejects OPTIONS requests with a body (400). Relates #95112
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Jun 15, 2023
Hooks "REST" authN, as a "validator", into the new netty channel interceptor for http headers.
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Jun 15, 2023
This address HTTP OPTIONS requests following the authentication refactoring in elastic#95112. Relates elastic#95112
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Jun 15, 2023
Instead of not authN and letting them through, this PR rejects OPTIONS requests with a body (400). Relates elastic#95112
albertzaharovits added a commit to albertzaharovits/elasticsearch that referenced this pull request Jun 19, 2023
This PR tests that malformed HTTP requests that fail at the decoding stage don't go through validation and are further dispatched as bad requests. Related: elastic#95112
albertzaharovits added a commit that referenced this pull request Aug 23, 2023
This is a backport of multiple work items related to authentication enhancements for HTTP, which were originally merged in the 8.8 - 8.9 releases. Hence, the HTTP (only the netty4-based implementation (default), not the NIO one) authentication implementation gets a throughput boost (especially for requests failing authn). Relates to: ES-6188 #92220 #95112
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Hooks "REST" authN, as a "validator", into the new netty channel interceptor for http headers.