mirror of
https://github.com/lukaszraczylo/graphql-monitoring-proxy.git
synced 2026-10-12 05:32:36 +00:00
lukaszraczylo
8258b3d99a
The proxy derived per-user GraphQL cache keys from JWT claims without verifying the token signature (CWE-345). A remote attacker could forge a token that carried a victim's claim value and read the victim's cached response. This change adds opt-in signature verification behind JWT_VERIFY_SIGNATURE. The flag defaults to false, so an upgrade without a config change keeps the previous delegate-to-upstream behavior byte for byte. When verification is on, the operator must set exactly one key source: JWT_SECRET, JWT_PUBLIC_KEY, or JWT_JWKS_URL. The verifier pins the accepted algorithms to the key family through WithValidMethods and a type-switched keyfunc, and it refuses alg=none. This closes the algorithm-confusion class of attack. A present but invalid token now returns 401. A missing Authorization header stays anonymous. Startup fails loudly when verification is on and the key source is absent or unreadable, so the proxy can never boot half-configured.
80 lines
3.4 KiB
AMPL
80 lines
3.4 KiB
AMPL
module github.com/lukaszraczylo/graphql-monitoring-proxy
|
|
|
|
go 1.25.0
|
|
|
|
require (
|
|
github.com/MicahParks/keyfunc/v3 v3.8.1
|
|
github.com/VictoriaMetrics/metrics v1.44.0
|
|
github.com/alicebob/miniredis/v2 v2.33.0
|
|
github.com/avast/retry-go/v4 v4.7.0
|
|
github.com/goccy/go-json v0.10.6
|
|
github.com/gofiber/contrib/v3/websocket v1.2.0
|
|
github.com/gofiber/fiber/v3 v3.3.0
|
|
github.com/gofrs/flock v0.13.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.0
|
|
github.com/gookit/goutil v0.7.6
|
|
github.com/gorilla/websocket v1.5.3
|
|
github.com/graphql-go/graphql v0.8.1
|
|
github.com/jackc/pgx/v5 v5.10.0
|
|
github.com/lukaszraczylo/ask v0.0.0-20240916204100-6e9ef53a62d9
|
|
github.com/lukaszraczylo/go-ratecounter v0.1.12
|
|
github.com/lukaszraczylo/go-simple-graphql v1.2.89
|
|
github.com/lukaszraczylo/oss-telemetry v0.2.3
|
|
github.com/redis/go-redis/v9 v9.20.1
|
|
github.com/sony/gobreaker v1.0.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/valyala/fasthttp v1.71.0
|
|
go.opentelemetry.io/otel v1.44.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0
|
|
go.opentelemetry.io/otel/sdk v1.44.0
|
|
go.opentelemetry.io/otel/trace v1.44.0
|
|
go.uber.org/automaxprocs v1.6.0
|
|
google.golang.org/grpc v1.82.1
|
|
)
|
|
|
|
require (
|
|
github.com/MicahParks/jwkset v0.11.1 // indirect
|
|
github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
|
|
github.com/andybalholm/brotli v1.2.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/fasthttp/websocket v1.5.12 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/gofiber/schema v1.7.1 // indirect
|
|
github.com/gofiber/utils/v2 v2.0.6 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/savsgio/gotils v0.0.0-20250924091648-bce9a52d7761 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fastrand v1.1.0 // indirect
|
|
github.com/valyala/histogram v1.2.0 // indirect
|
|
github.com/yuin/gopher-lua v1.1.1 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
golang.org/x/crypto v0.53.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/sync v0.21.0 // indirect
|
|
golang.org/x/sys v0.46.0 // indirect
|
|
golang.org/x/term v0.44.0 // indirect
|
|
golang.org/x/text v0.39.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260618152121-87f3d3e198d3 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|