Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

caduceus delivers events to hooks registered with https + ip address #154

Open
ilawjr opened this issue Aug 21, 2019 · 2 comments
Open

caduceus delivers events to hooks registered with https + ip address #154

ilawjr opened this issue Aug 21, 2019 · 2 comments
Labels
argus-webhooks Securing webhooks for the switch to argus enhancement

Comments

@ilawjr
Copy link

ilawjr commented Aug 21, 2019

Caduceus will deliver events using https with an ip address e.g. https://96.118.136.239:443/api/v3/notify. This should fail as the cert won't match an ip address. Or, this should fail at the registration step. We do allow http + ip address - which is expected.

To reproduce

  1. set up https listener with proper certs and route 53 path
  2. register a webhook using the ip address of the server in step 1. e.g. https://96.118.136.239:443/api/v3/notify.
  3. send the event to caduceus
    the event is received
@schmidtw
Copy link
Member

We originally decided to explicitly allow this pattern, but times have changed since 3d2f26a

The thinking is for non-globally route-able addresses requiring a matching hostname may be an issue.

This seems like something we should control via configuration.

@kristinapathak
Copy link
Contributor

This seems like it could be fixed as a part of this issue:
https://github.com/xmidt-org/webpa-common/issues/475

@joe94 joe94 added the argus-webhooks Securing webhooks for the switch to argus label May 21, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
argus-webhooks Securing webhooks for the switch to argus enhancement
Projects
None yet
Development

No branches or pull requests

4 participants