feat(proxy-backend): support limiting the proxied HTTP methods

docs/plugins/proxying.md

@@ -52,7 +52,10 @@ configuration will lead to the proxy acting on backend requests to
 
 The value inside each route is either a simple URL string, or an object on the
 format accepted by
-[http-proxy-middleware](https://www.npmjs.com/package/http-proxy-middleware).
+[http-proxy-middleware](https://www.npmjs.com/package/http-proxy-middleware). It
+is also possible to limit the forwarded HTTP methods with the configuration
+`allowedMethods`, for example `allowedMethods: ['GET']` to enforce read-only
+access.
 
 If the value is a string, it is assumed to correspond to:
 

plugins/proxy-backend/package.json

@@ -22,6 +22,7 @@
     "@backstage/backend-common": "^0.1.1-alpha.21",
     "@backstage/config": "^0.1.1-alpha.21",
     "@types/express": "^4.17.6",
+    "@types/http-proxy-middleware": "^0.19.3",
     "express": "^4.17.1",
     "express-promise-router": "^3.0.3",
     "http-proxy-middleware": "^0.19.1",

plugins/proxy-backend/src/service/router.ts

@@ -18,10 +18,11 @@ import { Config } from '@backstage/config';
 import express from 'express';
 import Router from 'express-promise-router';
 import createProxyMiddleware, {
-  Config as ProxyConfig,
+  Config as ProxyMiddlewareConfig,
   Proxy,
 } from 'http-proxy-middleware';
 import { Logger } from 'winston';
+import http from 'http';
 
 export interface RouterOptions {
   logger: Logger;
@@ -30,6 +31,10 @@ export interface RouterOptions {
   pathPrefix: string;
 }
 
+export interface ProxyConfig extends ProxyMiddlewareConfig {
+  allowedMethods?: string[];
+}
+
 // Creates a proxy middleware, possibly with defaults added on top of the
 // given config.
 function buildMiddleware(
@@ -58,7 +63,12 @@ function buildMiddleware(
   // Attach the logger to the proxy config
   fullConfig.logProvider = () => logger;
 
-  return createProxyMiddleware(fullConfig);
+  // Only permit the allowed HTTP methods if configured
+  const filter = (_pathname: string, req: http.IncomingMessage): boolean => {
+    return fullConfig?.allowedMethods?.includes(req.method!) ?? true;
+  };
+
+  return createProxyMiddleware(filter, fullConfig);
 }
 
 export async function createRouter(

yarn.lock

@@ -4209,7 +4209,7 @@
   resolved "https://registry.npmjs.org/@types/http-errors/-/http-errors-1.8.0.tgz#682477dbbbd07cd032731cb3b0e7eaee3d026b69"
   integrity sha512-2aoSC4UUbHDj2uCsCxcG/vRMXey/m17bC7UwitVm5hn22nI8O8Y9iDpA76Orc+DWkQ4zZrOKEshCqR/jSuXAHA==
 
-"@types/http-proxy-middleware@*":
+"@types/http-proxy-middleware@*", "@types/http-proxy-middleware@^0.19.3":
   version "0.19.3"
   resolved "https://registry.npmjs.org/@types/http-proxy-middleware/-/http-proxy-middleware-0.19.3.tgz#b2eb96fbc0f9ac7250b5d9c4c53aade049497d03"
   integrity sha512-lnBTx6HCOUeIJMLbI/LaL5EmdKLhczJY5oeXZpX/cXE4rRqb3RmV7VcMpiEfYkmTjipv3h7IAyIINe4plEv7cA==