Repository navigation
JITSU-261: bearer authentication for the functions-server API - #1603
Closed
sahiltyagi-jitsu wants to merge 2 commits into
Closed
sahiltyagi-jitsu wants to merge 2 commits into
sahiltyagi-jitsu wants to merge 2 commits into
Conversation
/udfrun and the other endpoints trusted any caller that could reach the pod and used the workspaceId from the request body. With FUNCTIONS_SERVER_AUTH_TOKENS or FUNCTIONS_SERVER_RAW_AUTH_TOKENS set the server now requires a matching bearer token (compared in constant time) on every route except the health check. Rotor's own callers send FUNCTIONS_SERVER_AUTH_KEY; the console and ingest already send ROTOR_AUTH_KEY. Off until tokens are configured. JITSU-261
sahiltyagi-jitsu
marked this pull request as ready for review
October 27, 2026 07:42
Comment on lines
+84
to
+86
| // Functions server HTTP auth (see lib/functions-server-auth.ts). Tokens set on the functions-server, key on its callers | ||
| FUNCTIONS_SERVER_AUTH_TOKENS: z.string().optional(), | ||
| FUNCTIONS_SERVER_RAW_AUTH_TOKENS: z.string().optional(), |
There was a problem hiding this comment.
[P1] [P1] Forward auth tokens through the functions-server operator
Operator-managed functions servers cannot retain these settings. bulker/operator/operator.go builds a fixed container environment without either token variable, and its configuration has no token forwarding or Secret reference. Manually enabling authentication on a Deployment is also undone when a function/configuration change triggers updateDeploymentFromData, which replaces the pod template. The replacement pods therefore silently return to unauthenticated access. Wire the token settings through the operator and its configuration hash so authentication survives reconciliation.
…l Deno server JITSU-261
Contributor
|
already fixed |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JITSU-261(audit finding T3, Critical). Part ofJITSU-250. Companion infra PR is injitsu-cloud-infra(ingress policy).Problem
The functions-server HTTP API (
/udfrun,/multi,/connection/...) trusted any caller that could reach the pod and used theworkspaceIdfrom the request body.Change
Bearer authentication, off until tokens are configured:
FUNCTIONS_SERVER_AUTH_TOKENS(hashed) orFUNCTIONS_SERVER_RAW_AUTH_TOKENS. Every route except/healthneeds a matching token, compared in constant time. Rotor's own callers sendFUNCTIONS_SERVER_AUTH_KEY; the console and ingest already sendROTOR_AUTH_KEY. New env names, so rotor's ownROTOR_AUTH_TOKENSis untouched.Verified
Run against a real Deno server (added)
functions-chainsuite passes against the real Denofunctions-serverwith the auth code present and no tokens configured (default open behaviour unchanged).functions-server-auth.e2e.test.ts(7 tests) starts the real server with two tokens configured and calls it over HTTP:/healthstays open;/udfrun,/profileudfrun,/multiand/connection/...return 401 without a token, with a wrong, truncated, or non-Bearer token; both configured tokens get past authentication.Not verified / rollout
FUNCTIONS_SERVER_AUTH_KEYon rotor/profiles first, using the same key the console and ingest send.