mgomes / api_auth

HMAC authentication for Rails and HTTP Clients
MIT License
480 stars 147 forks source link

Intermittent Timeouts with RestClient Requests #210

Closed camerondrysdale closed 1 year ago

camerondrysdale commented 1 year ago

I'm experimenting with this gem as an alternative to secure some API's in two of our Rails apps that talk to each other.

An example method that makes a request might look like:

def index
  request = RestClient::Request.new(
    url: 'http://localhost:3000/api/v1/ping',
    method: :get
  )
  signed_request = ApiAuth.sign!(request, access_id, secret_key)
  response = signed_request.execute
  render json: { code: response.code, content: response.body }
rescue StandardError => e
  Rails.logger.error "#{self.class} - #{e.class}: #{e.message}" + e.backtrace.join("\n")
  render json: { error: e.message }
end

access_id and secret_key have been hard-coded for the purpose of testing.

And then in the API itself:

def ping
  return render json: { error: 'unauthorized' }, status: :unauthorized unless api_authenticated

  render json: { data: 'Hello world' }
end

private

def api_authenticated
  ApiAuth.authentic?(request, secret_key)
end

I've seen this work a few times by loading the index and seeing the response outputted proving that it does indeed authenticate and return the response from the API. However it repeatable will become stuck... and then fall into the StandardError with a timeout exception:

ApiController - RestClient::Exceptions::ReadTimeout: Timed out reading data from server/Users/cameron/.rbenv/versions/2.5.3/lib/ruby/gems/2.5.0/gems/rest-client-2.1.0/lib/restclient/request.rb:751:in `rescue in transmit'

This API isn't doing anything with databases and is just returning simple JSON, so not sure why it does this...

Any ideas what could be the cause? And why it works sometimes, but then will fail with a timeout?

camerondrysdale commented 1 year ago

Actually after commenting out the API Auth code, I still see this happening... so seems it's a flaw in RestClient itself.