From 3619ea4c47e87a5ab20eb26290ed3d542d7f7c71 Mon Sep 17 00:00:00 2001 From: Dominik Henneke Date: Thu, 26 Nov 2020 16:13:51 +0100 Subject: [PATCH 1/4] Add a configuration schema for the proxy plugin --- .changeset/weak-roses-search.md | 5 +++ app-config.yaml | 2 +- plugins/proxy-backend/config.d.ts | 53 ++++++++++++++++++++++++++++++ plugins/proxy-backend/package.json | 6 ++-- 4 files changed, 63 insertions(+), 3 deletions(-) create mode 100644 .changeset/weak-roses-search.md create mode 100644 plugins/proxy-backend/config.d.ts diff --git a/.changeset/weak-roses-search.md b/.changeset/weak-roses-search.md new file mode 100644 index 0000000000..9f5074ce48 --- /dev/null +++ b/.changeset/weak-roses-search.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-proxy-backend': patch +--- + +Add configuration schema for the commonly used properties diff --git a/app-config.yaml b/app-config.yaml index 546d00466a..95c6b9006a 100644 --- a/app-config.yaml +++ b/app-config.yaml @@ -38,7 +38,7 @@ proxy: headers: Authorization: $env: TRAVISCI_AUTH_TOKEN - travis-api-version: 3 + travis-api-version: '3' '/newrelic/apm/api': target: https://api.newrelic.com/v2 diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts new file mode 100644 index 0000000000..3db4f47d68 --- /dev/null +++ b/plugins/proxy-backend/config.d.ts @@ -0,0 +1,53 @@ +/* + * Copyright 2020 Spotify AB + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +export interface Config { + /** + * A list of forwarding-proxies. Each key is a route to match, + * below the prefix that the proxy plugin is mounted on. I must + * start with a '/'. + */ + proxy: { [key: string]: string | ProxyConfig }; +} + +interface ProxyConfig { + /** + * Target of the proxy. Url string to be parsed with the url module. + */ + target: string; + /** + * Object with extra headers to be added to target requests. + */ + headers?: { [key: string]: string }; + /** + * Changes the origin of the host header to the target URL. Default: true. + */ + changeOrigin?: boolean; + /** + * Rewrite target's url path. Object-keys will be used as RegExp to match paths. + * If pathRewrite is not specified, it is set to a single rewrite that removes the entire prefix and route. + */ + pathRewrite?: { [regexp: string]: string }; + /** + * Limit the forwarded HTTP methods, for example allowedMethods: ['GET'] to enforce read-only access. + */ + allowedMethods?: string[]; + /** + * Limit the forwarded HTTP methods. By default, only the headers that are considered safe for CORS + * and headers that are set by the proxy will be forwarded. + */ + allowedHeaders?: string[]; +} diff --git a/plugins/proxy-backend/package.json b/plugins/proxy-backend/package.json index 22acdd3fe8..1283f9d261 100644 --- a/plugins/proxy-backend/package.json +++ b/plugins/proxy-backend/package.json @@ -41,6 +41,8 @@ "supertest": "^4.0.2" }, "files": [ - "dist" - ] + "dist", + "config.d.ts" + ], + "configSchema": "config.d.ts" } From 1b7a9d7317aee61398460f46572ba9f4621794ec Mon Sep 17 00:00:00 2001 From: Dominik Henneke Date: Thu, 26 Nov 2020 16:14:42 +0100 Subject: [PATCH 2/4] Refactor the proxying docs so the paragraph structure makes more sense --- docs/plugins/proxying.md | 29 ++++++++++++++++------------- plugins/proxy-backend/config.d.ts | 2 +- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/plugins/proxying.md b/docs/plugins/proxying.md index f55b4d9229..ac0d110010 100644 --- a/docs/plugins/proxying.md +++ b/docs/plugins/proxying.md @@ -52,19 +52,7 @@ configuration will lead to the proxy acting on backend requests to The value inside each route is either a simple URL string, or an object on the format accepted by -[http-proxy-middleware](https://www.npmjs.com/package/http-proxy-middleware). It -is also possible to limit the forwarded HTTP methods with the configuration -`allowedMethods`, for example `allowedMethods: ['GET']` to enforce read-only -access. - -By default, the proxy will only forward safe HTTP request headers to the target. -Those are based on the headers that are considered safe for CORS and includes -headers like `content-type` or `last-modified`, as well as all headers that are -set by the proxy. If the proxy should forward other headers like -`authorization`, this must be enabled by the `allowedHeaders` config, for -example `allowedHeaders: ['Authorization']`. This should help to not -accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to -third-parties. +[http-proxy-middleware](https://www.npmjs.com/package/http-proxy-middleware). If the value is a string, it is assumed to correspond to: @@ -85,3 +73,18 @@ except with the following caveats for convenience: `'^/api/proxy/larger-example/v1/': '/'` is added. That means that a request to `/api/proxy/larger-example/v1/some/path` will be translated to a request to `http://larger.example.com:8080/svc.v1/some/path`. + +There are also additional settings: + +- `allowedMethods`: Limit the forwarded HTTP methods. For example + `allowedMethods: ['GET']` enforces read-only access. +- `allowedHeaders`: A list of headers that should be forwarded to the target. + +By default, the proxy will only forward safe HTTP request headers to the target. +Those are based on the headers that are considered safe for CORS and includes +headers like `content-type` or `last-modified`, as well as all headers that are +set by the proxy. If the proxy should forward other headers like +`authorization`, this must be enabled by the `allowedHeaders` config, for +example `allowedHeaders: ['Authorization']`. This should help to not +accidentally forward confidential headers (`cookie`, `X-Auth-Request-User`) to +third-parties. diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts index 3db4f47d68..122d052c1c 100644 --- a/plugins/proxy-backend/config.d.ts +++ b/plugins/proxy-backend/config.d.ts @@ -17,7 +17,7 @@ export interface Config { /** * A list of forwarding-proxies. Each key is a route to match, - * below the prefix that the proxy plugin is mounted on. I must + * below the prefix that the proxy plugin is mounted on. It must * start with a '/'. */ proxy: { [key: string]: string | ProxyConfig }; From 8432bde46ab2c8bbdd5bee59de35e905b85c3572 Mon Sep 17 00:00:00 2001 From: Dominik Henneke Date: Fri, 27 Nov 2020 11:11:03 +0100 Subject: [PATCH 3/4] Use inline type instead of a dedicated interface --- plugins/proxy-backend/config.d.ts | 62 ++++++++++++++++--------------- 1 file changed, 32 insertions(+), 30 deletions(-) diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts index 122d052c1c..8bb7e958b8 100644 --- a/plugins/proxy-backend/config.d.ts +++ b/plugins/proxy-backend/config.d.ts @@ -20,34 +20,36 @@ export interface Config { * below the prefix that the proxy plugin is mounted on. It must * start with a '/'. */ - proxy: { [key: string]: string | ProxyConfig }; -} - -interface ProxyConfig { - /** - * Target of the proxy. Url string to be parsed with the url module. - */ - target: string; - /** - * Object with extra headers to be added to target requests. - */ - headers?: { [key: string]: string }; - /** - * Changes the origin of the host header to the target URL. Default: true. - */ - changeOrigin?: boolean; - /** - * Rewrite target's url path. Object-keys will be used as RegExp to match paths. - * If pathRewrite is not specified, it is set to a single rewrite that removes the entire prefix and route. - */ - pathRewrite?: { [regexp: string]: string }; - /** - * Limit the forwarded HTTP methods, for example allowedMethods: ['GET'] to enforce read-only access. - */ - allowedMethods?: string[]; - /** - * Limit the forwarded HTTP methods. By default, only the headers that are considered safe for CORS - * and headers that are set by the proxy will be forwarded. - */ - allowedHeaders?: string[]; + proxy: { + [key: string]: + | string + | { + /** + * Target of the proxy. Url string to be parsed with the url module. + */ + target: string; + /** + * Object with extra headers to be added to target requests. + */ + headers?: { [key: string]: string }; + /** + * Changes the origin of the host header to the target URL. Default: true. + */ + changeOrigin?: boolean; + /** + * Rewrite target's url path. Object-keys will be used as RegExp to match paths. + * If pathRewrite is not specified, it is set to a single rewrite that removes the entire prefix and route. + */ + pathRewrite?: { [regexp: string]: string }; + /** + * Limit the forwarded HTTP methods, for example allowedMethods: ['GET'] to enforce read-only access. + */ + allowedMethods?: string[]; + /** + * Limit the forwarded HTTP methods. By default, only the headers that are considered safe for CORS + * and headers that are set by the proxy will be forwarded. + */ + allowedHeaders?: string[]; + }; + }; } From 0e1f240a99dff96087b626365d5b23f73e487594 Mon Sep 17 00:00:00 2001 From: Dominik Henneke Date: Fri, 27 Nov 2020 11:24:59 +0100 Subject: [PATCH 4/4] Change the proxy setting to be optional --- plugins/proxy-backend/config.d.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts index 8bb7e958b8..e9b0f45893 100644 --- a/plugins/proxy-backend/config.d.ts +++ b/plugins/proxy-backend/config.d.ts @@ -20,7 +20,7 @@ export interface Config { * below the prefix that the proxy plugin is mounted on. It must * start with a '/'. */ - proxy: { + proxy?: { [key: string]: | string | {