From d1be48bcfabb3df44006afdf75636dbe31da68e8 Mon Sep 17 00:00:00 2001 From: Aramis Date: Sat, 27 Jan 2024 16:59:44 -0500 Subject: [PATCH] add warning and prevent startup in production. Signed-off-by: Aramis Signed-off-by: aramissennyeydd --- plugins/auth-backend-module-guest-provider/README.md | 2 +- plugins/auth-backend-module-guest-provider/src/module.ts | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/plugins/auth-backend-module-guest-provider/README.md b/plugins/auth-backend-module-guest-provider/README.md index 9c297aebe6..471b522859 100644 --- a/plugins/auth-backend-module-guest-provider/README.md +++ b/plugins/auth-backend-module-guest-provider/README.md @@ -2,7 +2,7 @@ This module provides a guest auth provider implementation for `@backstage/plugin-auth-backend`. This is meant to supersede the existing `'guest'` option for authentication that does not emit tokens and is completely stored as frontend state. -**NOTE**: +**NOTE**: This provider should only ever be enabled for `development` or `test`. Enabling this for production is strongly discouraged as it would give everyone a way to bypass your other authentication methods. ## Installation diff --git a/plugins/auth-backend-module-guest-provider/src/module.ts b/plugins/auth-backend-module-guest-provider/src/module.ts index 69b5eba48d..ad5c8c95a0 100644 --- a/plugins/auth-backend-module-guest-provider/src/module.ts +++ b/plugins/auth-backend-module-guest-provider/src/module.ts @@ -30,6 +30,11 @@ export const authModuleGuestProvider = createBackendModule({ providers: authProvidersExtensionPoint, }, async init({ providers }) { + if (process.env.NODE_ENV === 'production') { + throw new Error( + 'Guest provider does not support authenticating production workloads.', + ); + } providers.registerProvider({ providerId: 'guest', factory: createGuestAuthProviderFactory(),