Open Default2882 opened 3 days ago
As per discussion on discord - "We trust the executor to not need api keys to talk to the server. The client is meant to be used by user code which is untrusted. The open source server doesn’t have any security mechanisms built in. We expect folks building a platform with indexify to build their authentication mechanisms on top."
Closing
Context -
While working on #1007 I realised that, downloader.py and task_reporter.py use the basic
httpx
client instead of the IndexifyClient wrapper for httpx.Why is this bad -
IndexifyClient
has an optional parameter to take in the api_key, as per the current implementation thedownloader
andtask_reporter
will stop working if the server expects anapi_key
, and this needs to be fixed.Fix -
Simply use
IndexifyClient
instead ofhttpx
client, reference can be taken from this PR #1046