I am trying to use a signed proxy redirect to only allow my netlify function to be called by netilfy.
I updated my netlify.toml file like below and added an env variable to the build called “API_SIGNATURE_TOKEN”, but when I check the request cookies (just logging all cookies atm) in the function I don’t see the jwt to validate with.
site: nervous-lewin-928377
Just reading through docs again. Maybe this isn’t the best way to accomplish what I want. I was trying to add some sort of guard against someone just repeatedly calling the endpoint outside of the app. But since the app isn’t gated at the moment I guess that’s not really possible after thinking about it a bit more.
First off, these are JWS’s not JWT’s! You aren’t authenticating - just authorizing. The way you’d use that data to gate is:
not as automagic as you were hoping, but simpler than JWT handling, I think since you get all you need in the initial request and it’s then possible for your server to make a call “proceed, or don’t” based just on the info in that request.
hey there, just letting you know we haven’t forgotten about this thread and are hoping to get you some more info soon.
Hi @anon6271552,
Yes, this way (or probably any other too) you won’t be able to secure the endpoints, at least not the Netlify Functions.
Even if you you setup a redirect rule from /api/* to your Netlify Function, your actual endpoint (/.netlify/functions/foo/) is still vulnerable and could be hit by bypassing the redirect altogether. This way, even RBAC can’t save you. They would be able to protect your /api/* routing, but not the actual endpoint. However, with RBAC you’ve a chance. You could setup a different redirect rule for each function and use RBAC on that. So no one would be actually able to guess the endpoint’s URL and since they can’t know, the only way for them would be to pass through the RBAC checks.
I have a solution that might be useful (I use it currently). You could use Netlify Identity and create a random user with a random email and password. Then, you could pass that user using the Authorisation header to your functions. Inside the functions, you could verify if that Auth token is valid valid user of your website and authorise the function accordingly. To further increase the security, I delete the user inside the function so that no one can exploit the Auth token. It’s not fool-proof (I can explain why if needed), but does add a robust security mechanism.
If this sounds like a workable solution, I can provide you with an example of how I do it. It’s not super practical probably, but gets the job done.
A note though: If by protecting the endpoint you mean that you don’t wish for the functions invocations to be consumed, that won’t be possible. Even if you have any kind of checks inside the function to authorise or deny access, that would be counted as an invocation.
@anon6271552 not sure if this helps but I ended up just using netlify identity + sign-in page to somewhat limit/protect the various netlify functions. More detail here Netlify identity and go functions. I’m sure it’s a little dated at this point, but that was what I did at the time.