hasura / hasura/graphql-engine
Add IP list DENY/Allow for Admin Access using the x-hasura-secret-key
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
x-hasura-secret-key is makes it easy to apply migrations over ingress to a running hasura instance, however the endpoint is vulnerable to attacks designed to learn the secret if exposed over a public network.
_**Please add an IP list DENY/ALLOW for requests made by x-hasura-admin-secret**_
This feature could be used to allow administrative access via a private subnet or other specific public ip addresses.
Contributor guide
Research direction
No files, tests, or entry points are named. First locate the request handling for x-hasura-admin-secret, then determine how an IP allow/deny policy should be configured and enforced; done means administrative requests obey the configured private-subnet or public-IP restrictions.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authorization, backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100