posit-dev / posit-dev/kallichore
Validate bearer token when creating websocket connection
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Currently, Kallichore does bearer token validation on all the RPC endpoints that change state. For security reasons, we should also validate the bearer token when establishing a websocket connection; this is just a little more fiddly for the websocket endpoint since the Swagger crate doesn't extract the auth data from the request for us.
The token validation should go here:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the websocket endpoint in crates/kcserver/src/server.rs around lines 694-705, then compare how bearer tokens are validated on the state-changing RPC endpoints. Trace how the Swagger websocket request exposes authentication data, and confirm that establishing a websocket connection validates the bearer token before the connection proceeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100