feature: Add Bearer auth token support to subscriptions

metsfan commented 3 years ago

Describe the Feature Request

Right now it is not possible to have bearer authorization on a DGS subscription. Therefore if your subscription requires user authorization in order to succeed, it will not be possible.

Describe Preferred Solution

Allow some methodology for providing an authorization interceptor on the DGS subscription websocket

Describe Alternatives

Allow library clients to provide an alternative bean for the websocket handler.

paulbakker commented 3 years ago

Websockets don't have HTTP headers, which is why you can't use regular headers for this.

At Netflix we use a filter that basically takes the bearer out of a URL parameter. Since this isn't really standard, I'm not sure what the framework can/should do.

metsfan commented 3 years ago

So the Apollo clients allow you to provide a "payload" on the initial websocket connection. In the GraphQL kickstart library you can define a bean which extends ApolloSubscriptionConnectionListener and allows you to read from the initialization payload and update the Spring security context. See a code sample below from my project (which currently uses GraphQL kickstart).

If we could get something like this in DGS, it would be very helpful.

However I am interested in how you are doing this in Netflix. How do you access this URL parameter? And is there any way to execute this as a filter so I can still use the @PreAuthorize annotation on my @DgsSubscription method? Sorry if this is an obvious question. Will a regular filter be executed when the websocket connects?

EDIT - Ok I see waht you mean now, I created a new filter for the websocket connection and I see now how you mean you're extracting it in this way. This is a bit different from how Apollo iOS client wants you to authenticate but I suppose I'll go with it for now instead of asking you guys to change the library. I do think being able to extract the Apollo init payload would be nice. But I understand that there is a workaround so I'll go with that for now.

@Component
class SubscriptionConnectionListener(
    private val tokenAuthorizationFilter: TokenAuthorizationFilter,
    private val authenticator: TokenBasedAuthenticator
) : ApolloSubscriptionConnectionListener {
    override fun onConnect(session: SubscriptionSession?, message: OperationMessage?) {
        super.onConnect(session, message)

        (message?.payload as? Map<*, *>)?.let { payload ->
            payload[AuthorizationHeader]?.toString()?.let {
                session?.userProperties?.put(AuthorizationHeader, it)
            }
        }
    }

    override fun onStart(session: SubscriptionSession?, message: OperationMessage?) {
        super.onStart(session, message)

        session?.userProperties?.get(AuthorizationHeader)?.toString()?.let { authorization ->
            tokenAuthorizationFilter.readToken(authorization)?.let { token ->
                authenticator.authenticateUser(token)
            }
        }
    }
}

metsfan commented 3 years ago

This is what I mean btw. As you can see during the Subscription initialization, I've passed through a payload from the IOS client which has the Authorization header. All we need here is a listener here that passes through the payload. This is basically the "proper" way to authenticate clients with a websocket. Screen Shot 2021-06-28 at 2 10 17 PM

metsfan commented 3 years ago

@paulbakker I am going to implement this for my application. If I make a pull request do you think this is something you would consider incorporation?

paulbakker commented 3 years ago

Yes, definitely interested. It hasn't been an issue for us because we already had the authz filters available for Spring Boot, but ideally, it should just work out of the box with Apollo.

hantsy commented 3 years ago

Spring Security supports WebSocket, but not sure if it is simple to add extra authentication to the Spring SecurityContextHodler on the server-side automatically.

amondnet commented 3 years ago

https://www.apollographql.com/docs/graphql-subscriptions/authentication/ https://github.com/apollographql/subscriptions-transport-ws/blob/master/PROTOCOL.md#gql_connection_init

hantsy commented 3 years ago

The ApolloGraphQL subscription websocket protocol defines a connection init event which can be used to security context handling, it is better to add callbacks to all of these events, thus the handling can be customized.

Vertx Web GraphQL allows developers to add callbacks as expected.