search

Unleash / unleash-edge

MIT License
48 stars 8 forks source link

CUSTOM_CLIENT_HEADERS option not work #502

Closed petlitskiy closed 1 month ago

petlitskiy commented 2 months ago

Describe the bug

I am trying to set up Unleash-edge to handle client queries with client keys in the query header like Unleash-proxy allows to do it (i mean like Unleash-proxy allow to filter inbound queries with "UNLEASH_PROXY_CLIENT_KEYS" option). But with no success. Can you provide an example of docker-compose configuration of Unleash-edge to use "CUSTOM_CLIENT_HEADERS" option to filter inbound client's queries?

Steps to reproduce the bug

  1. set the CUSTOM_CLIENT_HEADERS: "X-Client-Key:mykey" in docker-compose environments block
  2. use like curl 'https://some-endpint/api/client/features' --header 'Content-Type: application/json' --header 'Authorization:default:development.xyz' --header 'X-Client-Key:mykey'
  3. use like curl 'https://some-endpint/api/client/features' --header 'Content-Type: application/json' --header 'Authorization:default:development.xyz' --header 'X-Client-Key:notmykey'
  4. in last case have to be filtered
  5. not filtered

Expected behavior

No response

Logs, error output, etc.

No response

Screenshots

No response

Additional context

No response

Unleash version

No response

Subscription type

None

Hosting type

None

SDK information (language and version)

No response

sighphyre commented 1 month ago

Hey @petlitskiy,

I don't think this is a bug. This is just a difference in behavior between the Proxy and Edge. The old UNLEASH_PROXY_CLIENT_KEYS option in the Proxy was a work around because there was no knowledge of the validity of tokens between the Proxy and Unleash itself. Edge takes a different approach - it won't respond to requests that aren't valid API keys in Unleash itself - the source of auth is Unleash and not Edge.

You can make Edge more strict with strict mode, but there's no way to limit it to specific tokens, any token that's valid upstream is also valid in Edge so long as it satisfies the constraints of strict mode.

The CUSTOM_CLIENT_HEADERS property you mention serves a different purpose - those are custom headers that Edge includes in its API requests to Unleash when hydrating data.

Hope this helps to clarify!