Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f6209e3

Browse files
barryobarryo
committed
[NF+] Secure API endpoints also, with transition period fallback to current api paths
1 parent dc02e81 commit f6209e3

5 files changed

Lines changed: 124 additions & 13 deletions

File tree

‎app/Http/Kernel.php‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -146,24 +146,25 @@ class Kernel extends HttpKernel
146146
* @var array
147147
*/
148148
protected $routeMiddleware = [
149+
'2fa' => Middleware\Google2FA::class,
150+
'apiauth' => Middleware\ApiAuthenticate::class,
151+
'apideprecated' => Middleware\ApiDeprecated::class,
152+
'apimaybeauth' => Middleware\ApiMaybeAuthenticate::class,
153+
'assert.privilege' => Middleware\AssertUserPrivilege::class,
149154
'auth' => Middleware\Authenticate::class,
150155
'auth.basic' => AuthenticateWithBasicAuth::class,
151156
'auth.session' => \Illuminate\Session\Middleware\AuthenticateSession::class,
152157
//'bindings' => SubstituteBindings::class,
153-
'can' => Authorize::class,
154158
'cache.headers' => SetCacheHeaders::class,
155-
'guest' => Middleware\RedirectIfAuthenticated::class,
156-
'signed' => Middleware\ValidateSignature::class,
157-
'throttle' => ThrottleRequests::class,
158-
'verified' => EnsureEmailIsVerified::class,
159-
'apiauth' => Middleware\ApiAuthenticate::class,
160-
'apimaybeauth' => Middleware\ApiMaybeAuthenticate::class,
161-
'assert.privilege' => Middleware\AssertUserPrivilege::class,
159+
'can' => Authorize::class,
162160
'controller-enabled' => Middleware\ControllerEnabled::class,
163161
'eloquent2Frontend' => Middleware\Eloquent2Frontend::class,
164162
'grapher' => Middleware\Services\Grapher::class,
163+
'guest' => Middleware\RedirectIfAuthenticated::class,
165164
'rs-prefixes' => Middleware\RsPrefixes::class,
166-
'2fa' => Middleware\Google2FA::class,
165+
'signed' => Middleware\ValidateSignature::class,
166+
'throttle' => ThrottleRequests::class,
167+
'verified' => EnsureEmailIsVerified::class,
167168
];
168169

169170
/**

‎app/Http/Middleware/ApiDeprecated.php‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
<?php
2+
3+
namespace IXP\Http\Middleware;
4+
5+
/*
6+
* Copyright (C) 2009 - 2026 Internet Neutral Exchange Association Company Limited By Guarantee.
7+
* All Rights Reserved.
8+
*
9+
* This file is part of IXP Manager.
10+
*
11+
* IXP Manager is free software: you can redistribute it and/or modify it
12+
* under the terms of the GNU General Public License as published by the Free
13+
* Software Foundation, version v2.0 of the License.
14+
*
15+
* IXP Manager is distributed in the hope that it will be useful, but WITHOUT
16+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
18+
* more details.
19+
*
20+
* You should have received a copy of the GNU General Public License v2.0
21+
* along with IXP Manager. If not, see:
22+
*
23+
* http://www.gnu.org/licenses/gpl-2.0.html
24+
*/
25+
26+
use Closure;
27+
28+
use Illuminate\Http\Request;
29+
use Illuminate\Support\Facades\Log;
30+
31+
32+
/**
33+
* Middleware: Log uses of deprecated APIs
34+
*
35+
* @author Barry O'Donovan <[email protected]>
36+
* @category IXP
37+
* @package IXP\Http\Middleware
38+
* @copyright Copyright (C) 2009 - 2026 Internet Neutral Exchange Association Company Limited By Guarantee
39+
* @license http://www.gnu.org/licenses/gpl-2.0.html GNU GPL V2.0
40+
*/
41+
class ApiDeprecated
42+
{
43+
/**
44+
* Handle an incoming request.
45+
*
46+
* @param Request $r
47+
* @param Closure $next
48+
* @return mixed
49+
*/
50+
public function handle( Request $r, Closure $next )
51+
{
52+
53+
Log::notice( 'UNPREPENDED/DEPRECATED usage of API request ' . $r->path() . ' from ' . ixp_get_client_ip() );
54+
55+
return $next( $r );
56+
}
57+
}

‎app/Providers/RouteServiceProvider.php‎

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -207,13 +207,28 @@ protected function mapApiAuthSuperuserRoutes(): void
207207
'middleware' => [
208208
'web',
209209
'api/v4',
210-
'assert.privilege:' . User::AUTH_SUPERUSER
210+
'assert.privilege:' . User::AUTH_SUPERUSER,
211211
],
212212
'namespace' => $this->namespace . '\\Api\\V4',
213-
'prefix' => 'api/v4',
213+
'prefix' => 'admin/api/v4',
214214
], function () {
215215
require base_path('routes/apiv4-auth-superuser.php');
216216
});
217+
218+
if( config( 'ixp_api.unsecured_api_access' ) ) {
219+
Route::group( [
220+
'middleware' => [
221+
'apideprecated',
222+
'web',
223+
'api/v4',
224+
'assert.privilege:' . User::AUTH_SUPERUSER,
225+
],
226+
'namespace' => $this->namespace . '\\Api\\V4',
227+
'prefix' => 'api/v4',
228+
], function() {
229+
require base_path( 'routes/apiv4-auth-superuser.php' );
230+
} );
231+
}
217232
}
218233

219234

@@ -232,10 +247,24 @@ protected function mapApiExternalAuthSuperuserRoutes(): void
232247
'assert.privilege:' . User::AUTH_SUPERUSER
233248
],
234249
'namespace' => $this->namespace . '\\Api\\V4',
235-
'prefix' => 'api/v4',
250+
'prefix' => 'admin/api/v4',
236251
], function () {
237252
require base_path('routes/apiv4-ext-auth-superuser.php');
238253
});
254+
255+
if( config( 'ixp_api.unsecured_api_access' ) ) {
256+
Route::group( [
257+
'middleware' => [
258+
'apideprecated',
259+
'api/v4',
260+
'assert.privilege:' . User::AUTH_SUPERUSER,
261+
],
262+
'namespace' => $this->namespace . '\\Api\\V4',
263+
'prefix' => 'api/v4',
264+
], function() {
265+
require base_path( 'routes/apiv4-ext-auth-superuser.php' );
266+
} );
267+
}
239268
}
240269

241270

‎config/ixp_api.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,4 +151,18 @@
151151
|
152152
*/
153153
'atlas_measurement_key' => env( 'ATLAS_MEASUREMENT_KEY', '' ),
154+
155+
156+
/*
157+
|--------------------------------------------------------------------------
158+
| Unsecured API paths
159+
|--------------------------------------------------------------------------
160+
|
161+
| IXP Manager v7.1.0 introduced an admin/ prepend on APIs for securing them.
162+
|
163+
| See: https://docs.ixpmanager.org/install/security/
164+
*/
165+
166+
'unsecured_api_access' => env( 'UNSECURED_API_ACCESS', true ),
167+
154168
];

‎config/ixp_fe_settings.php‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -538,7 +538,17 @@
538538
'help' => 'PeeringDB OAuth - post authentication redirect target on IXP Manager. Assuming your '
539539
. 'APP_URL is correct, then: <code>' . config('app.url') . '/auth/login/peeringdb/callback</code>'
540540
],
541-
541+
542+
'unsecured_api_access' => [
543+
'config_key' => 'ixp_api.unsecured_api_access',
544+
'dotenv_key' => 'UNSECURED_API_ACCESS',
545+
'type' => 'radio',
546+
'rules' => 'boolean',
547+
'name' => 'Unsecured API Access Enabled',
548+
'docs_url' => 'https://docs.ixpmanager.org/install/security/',
549+
'help' => 'IXP Manager v7.1.0 introduced an admin/ prepend on APIs for securing them. For v7.1.0 only, unsecured access will be enabled by default to allow administrators migrate their API clients.',
550+
],
551+
542552
],
543553

544554
],

0 commit comments

Comments
 (0)