hasura / hasura/graphql-engine

Add IP list DENY/Allow for Admin Access using the x-hasura-secret-key

Open
#7,596 3 comments 9 reactions 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

x-hasura-secret-key is makes it easy to apply migrations over ingress to a running hasura instance, however the endpoint is vulnerable to attacks designed to learn the secret if exposed over a public network.

_**Please add an IP list DENY/ALLOW for requests made by x-hasura-admin-secret**_

This feature could be used to allow administrative access via a private subnet or other specific public ip addresses.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. First locate the request handling for x-hasura-admin-secret, then determine how an IP allow/deny policy should be configured and enforced; done means administrative requests obey the configured private-subnet or public-IP restrictions.

Written by the indexing model from the issue text.

Assessment

Domain
api, authorization, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.