eclipse-thingweb / eclipse-thingweb/node-wot

Unusual behavior when configuring HTTPS from config file

Open
#177 4 comments 0 reactions 0 assignees View on GitHub
binding-http bug
Dominant language
TypeScript
Stars
192
Forks
100
Avg merge
3d 2h
Merged PRs (30d)
6

Description

Summary: We need strict validation of the security-related configuration in the config file passed to wot-servient CLI. The code expects a very strict config file where empty or wrong fields are not filled by defaults or any error reported, even with log level equal to debug (even for info level, there should be error messages).

Long version:
I want to have basic auth on an HTTP Thing that I instantiate via wot-servient CLI and by supplying a config file. I write the following config files and observe the following behavior. Only the relevant parts of the config file are shown:

- Forgetting `serverKey` or `serverCert`
```json
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem"
}
```
An HTTP server is started, without giving any information. This happens due to [this line](https://github.com/eclipse/thingweb.node-wot/blob/350fcf7cdf18e8e983cbaee8312c0240bce344a3/packages/binding-http/src/http-server.ts#L67).

- Forgetting `security`
```json
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem",
"serverCert":"/home/eko/git/thingweb.node-wot/examples/security/certificate.pem"
}
```
HTTPS server is instantiated but no need to use username password. This is intended but again no information is given.

- No credentials or wrong id
```jsonc
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem",
"serverCert":"/home/eko/git/thingweb.node-wot/examples/security/certificate.pem"
},
"credentials": { //this whole block can be removed for the same behavior
"urn:myThing": { //id in the counter.js is set to urn:uuid:counter
"username": "node-wot", // username key (not the value) can be changed to another string for the same behavior
"password": "hello" // password key (not the value) can be changed to another string for the same behavior
}
}
```
This is the most obscure case since:
1. Credentials object must be added
2. The id of thing from the script must be copy pasted. If the script does not have id, which is optional, a random id is generated.
3. `username` and `password` keys must be put correctly and not `identity` and `psk`. So the programmer must know what keys should be for the given security scheme above.

If all these and also the ones above, are not done perfectly, a Thing is created with an unknown username-password.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.