reacherhq/backend

Make `x-saasify-proxy-secret` optional

amaury1093 opened this issue · 0 comments

Right now, all requests going through this backend must have a header x-saasify-proxy-secret set to the value of the RCH_SAASIFY_SECRET env variable (=="reacher_dev_secret" by default). This is used by https://reacher.email, to only allow authenticated backend-to-backend requests.

I propose to make this x-saasify-proxy-secret check optional:

  • if RCH_SAASIFY_SECRET env variable, then check x-saasify-proxy-secret header
  • if not, then don't check x-saasify-proxy-secret

The idea is to make the following warp Filter optional, depending if the RCH_SAASIFY_SECRET is set or not:

/// Warp filter to check that the header secret is correct. We accept headers
/// for auth that match:
/// - `x-saasify-proxy-secret`: this means auth is handled by saasify, we don't
/// care about auth anymore.
pub fn check_header(
) -> impl warp::Filter<Extract = (HeaderSecret,), Error = warp::Rejection> + Clone {
let saasify_secret = get_saasify_secret();
// See https://github.com/seanmonstar/warp/issues/503.
let saasify_secret: &'static str = Box::leak(Box::new(saasify_secret));
warp::header::exact_ignore_case(SAASIFY_SECRET_HEADER, saasify_secret)
.map(|| HeaderSecret::Saasify)
}