paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases Wiki Activity

Add warning about backend APIs not having auth by default

Browse Source 
Signed-off-by: Vladimir Masarik <masarik.vladimir7@gmail.com>
This commit is contained in:
Vladimir Masarik
2023-08-14 16:36:52 +02:00
parent 36a139d136
commit c2988744e8
3 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/slimy-spiders-pull.md
+5
View File
@@ -0,0 +1,5 @@
---
'@backstage/plugin-auth-backend': patch
---
Add warning about backend APIs not having auth by default
docs/auth/index.md
+2
View File
@@ -10,6 +10,8 @@ configure Backstage to have any number of authentication providers, but only
one of these will typically be used for sign-in, with the rest being used to provide
access external resources.
> Note: Backstage backend APIs are by default unauthenticated. Thus, if your Backstage instance is exposed to the Internet, anyone can access information in the Backstage. If you would like to learn more, read about how to [authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md).
## Built-in Authentication Providers
Backstage comes with many common authentication providers in the core library:
docs/permissions/getting-started.md
+1 -1
View File
@@ -36,7 +36,7 @@ Like many other parts of Backstage, the permissions framework relies on informat
## Optionally add cookie-based authentication
Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior.
Frontend requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior.
## Integrating the permission framework with your Backstage instance