gateway: add HMAC request signature authentication - #4652
Conversation
|
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
c60b2da to
8b9e740
Compare
244b87a to
b4539f1
Compare
| signatureHex := req.Header.Get(m.header) | ||
| if signatureHex == "" { | ||
| m.logger.With("header", m.header).Error("Signature header not found") | ||
| http.Error(w, "signature header not found", http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| signatureHex, ok := strings.CutPrefix(signatureHex, m.prefix) | ||
| if !ok { | ||
| m.logger.Debug("Signature prefix mismatch") | ||
| http.Error(w, "signature verification failed", http.StatusUnauthorized) | ||
| return | ||
| } | ||
|
|
||
| signature, err := hex.DecodeString(signatureHex) | ||
| if err != nil { | ||
| m.logger.With("error", err).Error("Signature header is not valid hex") |
There was a problem hiding this comment.
Rejection paths log at Error level for ordinary client-side auth failures (CONTRIBUTING.md §1.2.2)
1.2.2 Provides relevant logging to support troubleshooting. Unexpected behavior should emit warning or error logs. Normal operation should emit no logs.
A missing signature header (L117), a non-hex header value (L131) and a MAC mismatch (L166) are all fully attacker-controlled inputs on what is by design an internet-facing webhook endpoint. Any unauthenticated caller — including background port/path scanners, which will hit this path constantly — can therefore drive unbounded Error-level log volume, which pollutes logs and can fire error-rate alerts for what is normal operation of an authenticating endpoint.
This is also internally inconsistent: the prefix mismatch (L124) and signature length mismatch (L140) paths — the same class of "the caller sent a bad signature" event — log at Debug.
Suggested fix: demote the four caller-error rejection paths (missing header, bad hex, length mismatch, MAC mismatch) to Debug so they stay diagnosable without being remotely triggerable noise, keeping Warn/Error for conditions that indicate a real problem on our side (e.g. the body read failure at L154). If visibility into auth failures is wanted, a counter metric (§1.2.1) is a better fit than a per-request error log.
Adds an optional auth.hmac config block to the gateway input that authenticates incoming requests by verifying a hex-encoded HMAC signature (SHA-256 or SHA-512) of the raw request body against a shared secret, read from a configurable request header. When set it replaces the platform-managed JWT/RBAC authentication for the endpoint, supporting webhook-style callers that sign their payloads instead of presenting a bearer token (e.g. Terraform Cloud Run Tasks). The auth block is designed as an extension point for additional authentication mechanisms in the future.
b4539f1 to
211e9c1
Compare
2 participants
Adds an optional auth.hmac config block to the gateway input that authenticates incoming requests by verifying a hex-encoded HMAC signature (SHA-256 or SHA-512) of the raw request body against a shared secret, read from a configurable request header. When set it replaces the platform-managed JWT/RBAC authentication for the endpoint, supporting webhook-style callers that sign their payloads instead of presenting a bearer token (e.g. Terraform Cloud Run Tasks).
The auth block is designed as an extension point for additional authentication mechanisms in the future.
jira: DEVPROD-4607