feat(BA-524): Deprecate X-BackendAI-SSO header for pipeline service authentication
#3353
Conversation
github-actions
bot
added
comp:webserver
…353.feature.md Co-authored-by: octodog <[email protected]>
src/ai/backend/web/proxy.py
Outdated
| if proxy_path == "pipeline" and real_path.rstrip("/") == "login": | ||
| api_rqst.headers["X-BackendAI-SessionID"] = request.headers.get( | ||
| "X-BackendAI-SessionID", "" | ||
| ) |
There was a problem hiding this comment.
I dont' think rqst is a commonly used abbreviation. Would it be possible to rename it?
There was a problem hiding this comment.
Renaming the api_rqst will be a over-scoped task, as the name is used in various modules in this project.
Would you mind if I issue a new ticket for it and proceed in next work?
Thank you.
There was a problem hiding this comment.
Please create the rename task with priority: low and handle it when you have time. :)
There was a problem hiding this comment.
The task will be tracked by BA-469
| if proxy_path == "pipeline": | ||
| session_id = request.headers.get("X-BackendAI-SessionID", "") | ||
| if not (sso_token := request.headers.get("X-BackendAI-SSO")): | ||
| jwt_secret = config["pipeline"]["jwt"]["secret"] | ||
| now = datetime.now().astimezone() | ||
| payload = { | ||
| # Registered claims | ||
| "exp": now + timedelta(seconds=config["session"]["max_age"]), | ||
| "iss": "Backend.AI Webserver", | ||
| "iat": now, | ||
| # Private claims | ||
| "aiohttp_session": session_id, | ||
| "access_key": api_session.config.access_key, # since 23.03.10 | ||
| } | ||
| sso_token = jwt.encode(payload, key=jwt_secret, algorithm="HS256") | ||
| api_rqst.headers["X-BackendAI-SSO"] = sso_token | ||
| api_rqst.headers["X-BackendAI-SessionID"] = session_id |
There was a problem hiding this comment.
How does Fasttrack handle version compatibility?
When making changes this time, is there any risk of breaking functionality for clients using previous versions?
There was a problem hiding this comment.
It is recommended to use the same version as Backend.AI Core.
To enhance version compatibility, we may adopt a dedicated header (e.g., X-BackendAI-FastTrack-Version).
src/ai/backend/web/proxy.py
Outdated
| if real_path.rstrip("/") == "login": | ||
| api_session = await asyncio.shield(get_api_session(request, endpoint)) | ||
| else: | ||
| api_session = await asyncio.shield(get_anonymous_session(request, endpoint)) |
There was a problem hiding this comment.
Is there another way to identify it as a login path? Relying on the real_path could be fragile.
src/ai/backend/web/proxy.py
Outdated
| *, | ||
| is_anonymous: bool = False, | ||
| api_endpoint: Optional[str] = None, | ||
| extra_forwarding_headers: Iterable[str] | None = None, |
There was a problem hiding this comment.
Any suggestion?
| extra_forwarding_headers: Iterable[str] | None = None, | |
| extra_http_headers_to_forward: Iterable[str] | None = None, |
src/ai/backend/web/proxy.py
Outdated
| for hdr in {*HTTP_HEADERS_TO_FORWARD, *extra_forwarding_headers}: | ||
| if request.headers.get(hdr) is not None: | ||
| api_rqst.headers[hdr] = request.headers[hdr] |
There was a problem hiding this comment.
The header seems to allow being overridden, which poses a potential security risk.
src/ai/backend/web/server.py
Outdated
| pipeline_api_endpoint = config["pipeline"]["endpoint"] | ||
| pipeline_handler = partial(web_handler, is_anonymous=True, api_endpoint=pipeline_api_endpoint) | ||
| pipeline_login_handler = partial( | ||
| web_handler, | ||
| is_anonymous=False, | ||
| api_endpoint=pipeline_api_endpoint, | ||
| extra_forwarding_headers={"X-BackendAI-SessionID"}, | ||
| ) | ||
| pipeline_websocket_handler = partial( | ||
| websocket_handler, is_anonymous=True, api_endpoint=pipeline_api_endpoint.with_scheme("ws") | ||
| ) |
There was a problem hiding this comment.
It might be cleaner to separate and pass it from the handler layer. Please create a follow-up issue for refactoring.
rapsealk
changed the title
X-BackendAI-SSO header for pipeline service authenticationX-BackendAI-SSO header for pipeline service authentication
HyeockJinKim
deleted the
feature/EN-115-deprecate-pipeline-authentication-jwt
branch
Follow-up of #503 and #1350. (BA-524)
This pull request deprecates the JWT-based
X-BackendAI-SSOheader to reduce complexity in authentication process for the pipeline service.AS-IS
sequenceDiagram Client->>+Backend.AI Gateway: POST /pipeline/login/ (X-BackendAI-SessionID: ...) Backend.AI Gateway-->>+Backend.AI FastTrack: POST /login/ (X-BackendAI-SessionID: ..., X-BackendAI-SSO: ...) Backend.AI FastTrack-->>-Backend.AI Gateway: 200 OK (X-BackendAI-SSO: ...) Backend.AI Gateway-->>-Client: 200 OK (X-BackendAI-SSO: ...) Client->>+Backend.AI Gateway: POST /pipeline/.../ (X-BackendAI-SessionID: ..., X-BackendAI-SSO: ...) Backend.AI Gateway-->>+Backend.AI FastTrack: POST /.../ (X-BackendAI-SessionID: ..., X-BackendAI-SSO: ...) Backend.AI FastTrack-->>-Backend.AI Gateway: 200 OK Backend.AI Gateway->>-Client: 200 OKTO-BE
sequenceDiagram Client->>+Backend.AI Gateway: POST /pipeline/login/ (X-BackendAI-SessionID: ...) Backend.AI Gateway-->>+Backend.AI FastTrack: POST /login/ (X-BackendAI-SessionID: ...) Backend.AI FastTrack-->>-Backend.AI Gateway: 200 OK {"token": "AUTH_TOKEN"} Backend.AI Gateway-->>-Client: 200 OK {"token": "AUTH_TOKEN"} Client->>+Backend.AI Gateway: POST /pipeline/.../ (Authorization: "Bearer AUTH_TOKEN") Backend.AI Gateway-->>+Backend.AI FastTrack: POST /.../ (Authorization: "Bearer AUTH_TOKEN") Backend.AI FastTrack-->>-Backend.AI Gateway: 200 OK Backend.AI Gateway->>-Client: 200 OKChecklist: (if applicable)