From f612f630edf04b2bce43cb4a8dd7f3a93ae05a8c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 7 May 2024 12:40:26 +0200 Subject: [PATCH] docs updates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/empty-spoons-tell.md | 5 ++++- docs/plugins/proxying.md | 4 ++++ plugins/proxy-backend/config.d.ts | 22 ++++++++++++++++------ 3 files changed, 24 insertions(+), 7 deletions(-) diff --git a/.changeset/empty-spoons-tell.md b/.changeset/empty-spoons-tell.md index 8c68cdc721..44e3dceb6f 100644 --- a/.changeset/empty-spoons-tell.md +++ b/.changeset/empty-spoons-tell.md @@ -36,7 +36,10 @@ There are three possible `credentials` settings at this point: The value `dangerously-allow-unauthenticated` was the old default. The value `require` is the new default, so requests that were previously -permitted may now start resulting in `401 Unauthorized` responses. +permitted may now start resulting in `401 Unauthorized` responses. If you have +`backend.auth.dangerouslyDisableDefaultAuthPolicy` set to `true`, this does not +apply; the proxy will behave as if all endpoints were set to +`dangerously-allow-unauthenticated`. If you have proxy endpoints that require unauthenticated access still, please add `credentials: dangerously-allow-unauthenticated` to their declarations in diff --git a/docs/plugins/proxying.md b/docs/plugins/proxying.md index 0f37eec982..84ef62ffe8 100644 --- a/docs/plugins/proxying.md +++ b/docs/plugins/proxying.md @@ -66,6 +66,10 @@ values: you also add `allowedHeaders: ['Authorization']` to an endpoint configuration, then the Backstage token (if provided) WILL be forwarded. +Note that if you have `backend.auth.dangerouslyDisableDefaultAuthPolicy` set to +`true`, the `credentials` value does not apply; the proxy will behave as if all +endpoints were set to `dangerously-allow-unauthenticated`. + If the value is a string, it is assumed to correspond to: ```yaml diff --git a/plugins/proxy-backend/config.d.ts b/plugins/proxy-backend/config.d.ts index 710ff6d23f..ccce1c2d42 100644 --- a/plugins/proxy-backend/config.d.ts +++ b/plugins/proxy-backend/config.d.ts @@ -88,6 +88,11 @@ export interface Config { * are required to access this proxy target. The target can still * apply its own credentials checks, but the proxy will not help * block non-Backstage-blessed callers. + * + * Note that if you have + * `backend.auth.dangerouslyDisableDefaultAuthPolicy` set to `true`, + * the `credentials` value does not apply; the proxy will behave as + * if all endpoints were set to `dangerously-allow-unauthenticated`. */ credentials?: | 'require' @@ -151,15 +156,20 @@ export interface Config { * The values are as follows: * * - 'require': Callers must provide Backstage user or service - * credentials with each request. The credentials are not - * forwarded to the proxy target. + * credentials with each request. The credentials are not forwarded + * to the proxy target. * - 'forward': Callers must provide Backstage user or service * credentials with each request, and those credentials are * forwarded to the proxy target. - * - 'dangerously-allow-unauthenticated': No Backstage credentials - * are required to access this proxy target. The target can still - * apply its own credentials checks, but the proxy will not help - * block non-Backstage-blessed callers. + * - 'dangerously-allow-unauthenticated': No Backstage credentials are + * required to access this proxy target. The target can still apply + * its own credentials checks, but the proxy will not help block + * non-Backstage-blessed callers. + * + * Note that if you have + * `backend.auth.dangerouslyDisableDefaultAuthPolicy` set to `true`, + * the `credentials` value does not apply; the proxy will behave as if + * all endpoints were set to `dangerously-allow-unauthenticated`. */ credentials?: | 'require'