search

Unleash / unleash-proxy

Unleash Proxy is used to safely integrate frontend application with Unleash in a secure and scaleable way.
https://docs.getunleash.io/sdks/unleash-proxy
Apache License 2.0
48 stars 42 forks source link

Server side token config no long working in latest version v0.16.3 #140

Closed jlcrow closed 1 year ago

jlcrow commented 1 year ago

Describe the bug

I upgraded my container from version v0.13.1 to v0.16.3 - I'm utilizing the feature as an env variable EXP_SERVER_SIDE_SDK_CONFIG_TOKENS to allow my server side applications to talk to the proxy. I've changed no other configuration and the tokens remain the same through the upgrade process, the only thing changing is the version of the application. I've confirmed by rolling back and forth via helm that everything is the same except the container version. When I make the call with v0.13.1 it returns a 200 and the corresponding features, when I make the call with v0.16.3 I'm receiving a 401.

curl --location 'https://staging-features-scs.totalwine.com/proxy/client/features' \ --header 'Authorization: <redacted token>'

Steps to reproduce the bug

  1. Deploy version 13.1 with EXP_SERVER_SIDE_SDK_CONFIG_TOKENS env variable set to a token of your choice
  2. Make a curl to the /proxy/client/features endpoint with the token specified in 1 as an Authorization header
  3. Receive 200
  4. Upgrade to version 16.3
  5. Make same curl in #2
  6. Receive 401

Expected behavior

I would expect the behavior not to change with authorization

Unleash version

v5.1.7 console v0.16.3 proxy

Subscription type

Enterprise

Hosting type

Self-hosted

SDK information (language and version)

All server SDKs talking to proxy (Go, .net, Java)

ivarconr commented 1 year ago

Hi, you are absolutely right. This was allowed to happen, because we lacked a proper test for this experimental feature.

That being said, we have invested quite heavily in unleash-edge, which supports both frontend and server-side SDKs. It is much more flexible, and do support all SDKs and client tokens, dynamically. We realized that we could not support all needs via the exiting proxy.

If you plan to scale your server-side SDKs we strongly urge you to consider Unleash Edge, as this feature in the proxy will not move out of experimental phase. We will probably also take it away in a future major release, to limit the scope of the proxy.

That said, I have implemented a fix for this feature, with unit test, and will release that shortly.

jlcrow commented 1 year ago

Thanks @ivarconr, we are aware and plan to move to the edge proxy as soon as we remove our dependency on some custom strategies that were implemented early on in our use of unleash.

ivarconr commented 1 year ago

great. The proxy has been fixed and released as v0.16.4.