hasura / hasura/graphql-engine
Include Additional Details for Webhook Authentication Request Failures (Where Possible)
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
I have experienced some frustrating issues while troubleshooting webhook authentication failures. I have an open-source Django project that uses the Hasura GraphQL Engine. Hasura sends a webhook request (`/api/webhook`) to Nginx. I have ample logging on the Nginx/Django side of things, so it's easy to diagnose why a request is denied, but this is not the case if I get back the error `webhook authentication request failed`.
In these cases, the request is not logged by Nginx or Django. The Hasura container logs contain entries for a `webhook-log` and `http-log` (see below), but the messages and codes don't give me much to work with.
In a couple of cases, this issue was caused by an untrusted TLS connection. My project sets the webhook to `https://nginx:443/api/webhook` and there was an issue with `nginx` not matching the hostname on the TLS certificate for the web service. I was able to resolve the issue by changing the webhook to use the domain name for the certificate or by adding the hostname to Hasura's Insecure TLS Allow List.
Now I'm trying to help some people with this issue and the above solutions have not helped. It's been difficult to offer assistance through GitHub Issues and Slack messages with only logs like the ones I've included below.
```
{
"type": "webhook-log",
"timestamp": "2022-08-03T23:26:53.439+0000",
"level": "error",
"detail": {
"response": null,
"url": "http://host.docker.internal:443/api/webhook",
"method": "GET",
"http_error": {
"type": "http_exception",
"message": "Connection failure",
"request": {
"secure": false,
"path": "/api/webhook",
"responseTimeout": "ResponseTimeoutDefault",
"queryString": "",
"method": "GET",
"requestHeaders": {
"x-request-id": "0774e5d7-0295-4618-a3b9-d4425518b6d1",
"Content-Type": "application/json",
"cookie": "",
"X-Forwarded-Proto": "https",
"sec-fetch-dest": "empty",
"sec-fetch-site": "same-origin",
"sec-fetch-mode": "cors",
"User-Agent": "hasura-graphql-engine/v2.7.0",
"X-Real-IP": "172.23.0.1",
"X-Forwarded-Port": "443",
"X-Forwarded-For": "172.23.0.1"
},
"host": "host.docker.internal",
"port": 443
}
},
"message": null,
"status_code": null
}
}
{
"type": "http-log",
"timestamp": "2022-08-03T23:26:53.439+0000",
"level": "error",
"detail": {
"operation": {
"error": {
"path": "$",
"error": "webhook authentication request failed",
"code": "unexpected"
},
"request_id": "0774e5d7-0295-4618-a3b9-d4425518b6d1",
"response_size": 80,
"request_mode": "error",
"raw_query": "{\"query\":\" query IntrospectionQuery { __schema { queryType { name } mutationType { name } subscriptionType { name } types { ...FullType } directives { name description locations args { ...InputValue } } } } fragment FullType on __Type { kind name description fields(includeDeprecated: true) { name description args { ...InputValue } type { ...TypeRef } isDeprecated deprecationReason } inputFields { ...InputValue } interfaces { ...TypeRef } enumValues(includeDeprecated: true) { name description isDeprecated deprecationReason } possibleTypes { ...TypeRef } } fragment InputValue on __InputValue { name description type { ...TypeRef } defaultValue } fragment TypeRef on __Type { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name ofType { kind name } } } } } } } } \"}"
},
"request_id": "0774e5d7-0295-4618-a3b9-d4425518b6d1",
"http_info": {
"status": 200,
"http_version": "HTTP/1.1",
"url": "/v1/graphql",
"ip": "172.23.0.1",
"method": "POST",
"content_encoding": null
}
}
}
```
### Describe the solution you'd like
If it's possible, it'd be very helpful if these `webhook authentication request failed` errors could include additional details to indicate the connection was aborted due to an untrusted connection or some other issue.
### Describe alternatives you've considered
I have tried making adjustments to the Hasura configuration to get more log data but did not have any luck getting additional information for these events. I enabled `DEV_MODE` and tried changing logging settings. These are my current values for the applicable settings:
```
HASURA_GRAPHQL_DEV_MODE='false'
HASURA_GRAPHQL_ENABLED_LOG_TYPES='startup, http-log, webhook-log, websocket-log, query-log'
HASURA_GRAPHQL_INSECURE_SKIP_TLS_VERIFY='false'
HASURA_GRAPHQL_LOG_LEVEL='warn'
```
### If the feature is approved, would you be willing to submit a PR?
I'd be happy to help where I can, but I don't know if this is something I could do myself. I'm not familiar with Haskell.
Contributor guide
Assessment
This issue has not been assessed yet.