1
0
mirror of https://github.com/Unleash/unleash.git synced 2024-12-22 19:07:54 +01:00
unleash.unleash/website/docs/reference
Gastón Fournier 70499dc1d4
feat: allow api token middleware to fetch from db (#6344)
## About the changes
When edge is configured to automatically generate tokens, it requires
the token to be present in all unleash instances.
It's behind a flag which enables us to turn it on on a case by case
scenario.

The risk of this implementation is that we'd be adding load to the
database in the middleware that evaluates tokens (which are present in
mostly all our API calls. We only query when the token is missing but
because the /client and /frontend endpoints which will be the affected
ones are high throughput, we want to be extra careful to avoid DDoSing
ourselves

## Alternatives:
One alternative would be that we merge the two endpoints into one.
Currently, Edge does the following:
If the token is not valid, it tries to create a token using a service
account token and /api/admin/create-token endpoint. Then it uses the
token generated (which is returned from the prior endpoint) to query
/api/frontend. What if we could call /api/frontend with the same service
account we use to create the token? It may sound risky but if the same
application holding the service account token with permission to create
a token, can call /api/frontend via the generated token, shouldn't it be
able to call the endpoint directly?

The purpose of the token is authentication and authorization. With the
two tokens we are authenticating the same app with 2 different
authorization scopes, but because it's the same app we are
authenticating, can't we just use one token and assume that the app has
both scopes?

If the service account already has permissions to create a token and
then use that token for further actions, allowing it to directly call
/api/frontend does not necessarily introduce new security risks. The
only risk is allowing the app to generate new tokens. Which leads to the
third alternative: should we just remove this option from edge?
2024-02-27 16:08:44 +01:00
..
api/legacy/unleash
integrations feat: datadog integration - link to valid source type names (#5608) 2023-12-12 14:37:41 +01:00
sdks
activation-strategies.md
api-tokens-and-client-keys.mdx docs: add deprecation notice to Admin tokens (#5909) 2024-01-18 09:58:40 +01:00
archived-toggles.md
banners.md
change-requests.md docs: mention that environment-level variants also suspend CRs now (#6211) 2024-02-14 10:12:39 +09:00
custom-activation-strategies.md
dependent-features.md
environments.md
event-log.md
event-types.mdx
feature-flag-naming-patterns.mdx docs: update availability notice to say patterns were released in 5.7 (#6160) 2024-02-08 09:05:57 +09:00
feature-toggle-types.md
feature-toggle-variants.md doc: C++ client supports now feature toggle variants. (#5733) 2023-12-28 10:22:36 +01:00
feature-toggles.mdx
front-end-api.md feat: allow api token middleware to fetch from db (#6344) 2024-02-27 16:08:44 +01:00
impression-data.md
login-history.md
maintenance-mode.mdx
network-view.mdx
notifications.md
playground.mdx
project-collaboration-mode.md feat: add private collaboration mode docs (#5750) 2024-01-04 10:48:02 +02:00
projects.md
public-signup.mdx
rbac.md docs: Added the new more fine-grained project permissions to the docs (#6000) 2024-01-23 14:13:03 +01:00
search-operators.md chore: add documentation to search filters/operators (#6088) 2024-01-31 13:28:15 +02:00
segments.mdx
service-accounts.md
sso.md
stickiness.md
strategy-constraints.md
strategy-variants.md
tags.md
technical-debt.md fix: misc UI/UX fixes (#6241) 2024-02-15 08:17:11 +00:00
unleash-context.md
whats-new-v4.md