1

Context

I wrote an opensource plugin for an (opensource) code quality analysis tool (SonarQube). This plugin adds a set of REST services that generate badges as SVG images. The tool can be reachable through http or https (depending on how it is installed).

The REST services the plugin is adding have the specificity that they rely on data which is not visible to unauthentified users and which are provided by other services (for instance project quality gate status, metrics). As such, they require the user to be authentified prior to calling the services providing required data (which is irrealistic as the url is meant to be inserted in an <img> tag), or to provide credentials in the url as follows:

http://<SECURITY_TOKEN>@<private_server_ip>:<port>/<context_root>/api/xyz_service

or

https://<SECURITY_TOKEN>@<private_server_ip>:<port>/<context_root>/api/xyz_service

In my context, being able to access these badge generation services without being authentified is legit and accepted (not to say required) by users. However, I have two issues :

  1. In most cases <SECURITY_TOKEN> or even <private_server_ip> cannot be disclosed to the outside world.
  2. In some cases, even if disclosing <SECURITY_TOKEN> is acceptable, it doesn't work as some websites (such as GitHub's markdown) ignore the <AUTH>@<SERVER> syntax and do not pass <AUTH> when calling the url.

Unfortunately, so far SonarQube development team refused to allow (selected) public REST services to call private services without being authentified.

There is no other way to provide the security token.

What I want to achieve

I want to provide guidelines to help people setup a HaProxy reverse proxy in front of SonarQube, which, for each request sent to:

http://<public_server_ip>:80/api/xyz_service

...would forward it to:

http://<SECURITY_TOKEN>@<private_server_ip>:<port>/<context_root>/api/xyz_service

...or (if a https backend is used) would forward it to:

https://<SECURITY_TOKEN>@<private_server_ip>:<port>/<context_root>/api/xyz_service

This would allow people to use my badges extension (or any other extension) that relies on secured REST services, while keeping the security token and internal ip of the server secret (in other words, it would be a clean workaround to the above issues).

Note that parameters can be provided to the services. So far I'm only using GET HTTP method.

My request

I never used HaProxy so I have no clue how to do it, so:

  • Is it possible to achieve what I've described with HaProxy?
  • can you please help me?
  • Can you provide me with a sample minimalistic configuration ?

Thanks in advance for your help! (I'll be happy to list the people who will help me solve this issue as contributors to the project)

Best regards,

Michel

  • It may or may not be possible, depending on the specifics of the server implementation... but probably feasible. Please capture the response to a couple of unauthenticated requests using curl -v http://... specifically the WWW-Authenticate: header value. – Michael - sqlbot Nov 16 '16 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.