From c2988744e8da93f63d9e757aa50543e58a10ca16 Mon Sep 17 00:00:00 2001 From: Vladimir Masarik Date: Mon, 14 Aug 2023 16:36:52 +0200 Subject: [PATCH] Add warning about backend APIs not having auth by default Signed-off-by: Vladimir Masarik --- .changeset/slimy-spiders-pull.md | 5 +++++ docs/auth/index.md | 2 ++ docs/permissions/getting-started.md | 2 +- 3 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 .changeset/slimy-spiders-pull.md diff --git a/.changeset/slimy-spiders-pull.md b/.changeset/slimy-spiders-pull.md new file mode 100644 index 0000000000..12bd0e23e4 --- /dev/null +++ b/.changeset/slimy-spiders-pull.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Add warning about backend APIs not having auth by default diff --git a/docs/auth/index.md b/docs/auth/index.md index b2aac47e2a..6f3250559c 100644 --- a/docs/auth/index.md +++ b/docs/auth/index.md @@ -10,6 +10,8 @@ configure Backstage to have any number of authentication providers, but only one of these will typically be used for sign-in, with the rest being used to provide access external resources. +> Note: Backstage backend APIs are by default unauthenticated. Thus, if your Backstage instance is exposed to the Internet, anyone can access information in the Backstage. If you would like to learn more, read about how to [authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md). + ## Built-in Authentication Providers Backstage comes with many common authentication providers in the core library: diff --git a/docs/permissions/getting-started.md b/docs/permissions/getting-started.md index 01a268f7ef..0d542a6502 100644 --- a/docs/permissions/getting-started.md +++ b/docs/permissions/getting-started.md @@ -36,7 +36,7 @@ Like many other parts of Backstage, the permissions framework relies on informat ## Optionally add cookie-based authentication -Asset requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. +Frontend requests initiated by the browser will not include a token in the `Authorization` header. If these requests check authorization through the permission framework, as done in plugins like TechDocs, then you'll need to set up cookie-based authentication. Refer to the ["Authenticate API requests"](https://github.com/backstage/backstage/blob/master/contrib/docs/tutorials/authenticate-api-requests.md) tutorial for a demonstration on how to implement this behavior. ## Integrating the permission framework with your Backstage instance