Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When the server calls its own API it should not need to route via the internet #959

Closed
iainsproat opened this issue Aug 23, 2022 · 1 comment
Labels
bug Something isn't working [ devops ] security do not use this label: please report all security vulnerabilities at [email protected]

Comments

@iainsproat
Copy link
Contributor

iainsproat commented Aug 23, 2022

What package are you referring to?

Speckle Server

Describe the bug

The server calls its own GraphQL API in a number of locations. See example. These currently use the canonical domain.

In cases where this is a non-localhost and non-IP value, the call will likely be routed via the internet. Ideally we should ensure that all calls are sent via local loopback, i.e. to localhost, or - where deployed on kubernetes it would also be acceptable to send to a kubernetes service url speckle-server.speckle-namespace.svc.cluster.local., as this would provide some load balancing.

To Reproduce

  1. Enable Cilium Network Policy for speckle-server.
  2. Modify the Cilium Network Policy to remove egress from speckle-server to the internet or to the canonical domain.
  3. Attempt to import a file, triggering this call from speckle-server to the canonical url.

Expected behavior

Speckle-server should not require egress to the internet to call its own API.

Screenshots

System Info

Failure Logs

Additional context

#913

Proposed Solution (if any)

These calls should not use CANONICAL_URL environment variable and should instead use a separate environment variable; which is either a local loopback or a kubernetes service url.

@iainsproat iainsproat added bug Something isn't working security do not use this label: please report all security vulnerabilities at [email protected] labels Aug 23, 2022
@iainsproat
Copy link
Contributor Author

@iainsproat iainsproat closed this as not planned Won't fix, can't repro, duplicate, stale Aug 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working [ devops ] security do not use this label: please report all security vulnerabilities at [email protected]
Projects
None yet
Development

No branches or pull requests

2 participants