smartcontractkit / smartcontractkit/chainlink
[FEAT] Allow to set headers on External Adaptor calls
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.2k
- Forks
- 2k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 202
Description
Description
I want to protect an external adaptor so that only whitelist nodes can access it.
Right now, I can protect whoever makes requests to my operator.
Requesters -> Operator -> External Adaptor (This is secured!)
However, I can't protect who calls my External Adaptor directly.
Malicious Actor -> External Adaptor (Not secured)
Ideally on the UI below, we would be able to set an auth header with a secret api key.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the External Adaptor call configuration and the UI shown in the issue, then trace how requests reach the adaptor. Define how an authentication header and secret API key should be configured and sent, with completion requiring direct External Adaptor calls to be restricted to requests carrying the configured credential.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100