eclipse-thingweb / eclipse-thingweb/node-wot
Unusual behavior when configuring HTTPS from config file
- Dominant language
- TypeScript
- Stars
- 192
- Forks
- 100
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 6
Description
Summary: We need strict validation of the security-related configuration in the config file passed to wot-servient CLI. The code expects a very strict config file where empty or wrong fields are not filled by defaults or any error reported, even with log level equal to debug (even for info level, there should be error messages).
Long version:
I want to have basic auth on an HTTP Thing that I instantiate via wot-servient CLI and by supplying a config file. I write the following config files and observe the following behavior. Only the relevant parts of the config file are shown:
- Forgetting `serverKey` or `serverCert`
```json
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem"
}
```
An HTTP server is started, without giving any information. This happens due to [this line](https://github.com/eclipse/thingweb.node-wot/blob/350fcf7cdf18e8e983cbaee8312c0240bce344a3/packages/binding-http/src/http-server.ts#L67).
- Forgetting `security`
```json
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem",
"serverCert":"/home/eko/git/thingweb.node-wot/examples/security/certificate.pem"
}
```
HTTPS server is instantiated but no need to use username password. This is intended but again no information is given.
- No credentials or wrong id
```jsonc
"http":{
"port":8080,
"serverKey":"/home/eko/git/thingweb.node-wot/examples/security/privatekey.pem",
"serverCert":"/home/eko/git/thingweb.node-wot/examples/security/certificate.pem"
},
"credentials": { //this whole block can be removed for the same behavior
"urn:myThing": { //id in the counter.js is set to urn:uuid:counter
"username": "node-wot", // username key (not the value) can be changed to another string for the same behavior
"password": "hello" // password key (not the value) can be changed to another string for the same behavior
}
}
```
This is the most obscure case since:
1. Credentials object must be added
2. The id of thing from the script must be copy pasted. If the script does not have id, which is optional, a random id is generated.
3. `username` and `password` keys must be put correctly and not `identity` and `psk`. So the programmer must know what keys should be for the given security scheme above.
If all these and also the ones above, are not done perfectly, a Thing is created with an unknown username-password.
Contributor guide
Assessment
This issue has not been assessed yet.