CalvinKirs opened a new pull request, #66205:
URL: https://github.com/apache/doris/pull/66205
### What problem does this PR solve?
Issue Number: close #xxx
Related PR: #xxx
Problem Summary:
`enable_all_http_auth` defaulted to `false`. While it is off, part of the
HTTP surface answers without checking credentials or privileges:
- BE (8040): every handler declared with the `NONE` privilege type —
metrics, health, and some debug / metadata endpoints
- FE (8030): the privilege check on part of the admin REST surface
(`checkAdminAuth` is a no-op while the flag is off)
Enabling it is the right production posture, and shipping it off means most
deployments never do. This PR flips the default to `true` on both FE and BE,
and updates the security model accordingly: unauthenticated access to FE 8030 /
BE 8040 is now a **valid** finding rather than a by-design disclaimer, and
security assessments must be run with the flag on.
One deliberate carve-out: FE `/metrics` (`MetricsAction`) is public by
design and is **not** gated by this flag; BE `/metrics` is. The asymmetry is
documented in `threat-model.md` rather than changed here.
Test-side changes needed to make the new default work:
- **regression framework** — `curl()` and `http_client()` in
`plugin_curl_requester.groovy` fall back to the regression user when the caller
passes no explicit identity (callers that pass one are unaffected), plus the
raw `curl ${compact_url}` in `Suite.groovy`
- **regression suites** — 21 `httpTest` blocks and 76 raw shell `curl`
commands that drive BE HTTP endpoints now send credentials; `/vars` (BRPC
port), Meta Service (token auth) and FE `/metrics` are untouched
- **auth suites** — the `finally` blocks restored the flag to `"false"`,
which is no longer the default and would leak an unauthenticated cluster into
later suites
- **BE unit tests** — `run_all_tests.cpp` pins the shared test HTTP server
to the flag-off baseline, since `debug_points_test` posts to
`/api/debug_point/*` anonymously; `http_auth_test.cpp` no longer asserts the
default value
### Release note
**Behavior change:** `enable_all_http_auth` now defaults to `true` on FE and
BE, so FE and BE HTTP interfaces require credentials. Callers that poll these
interfaces anonymously — Prometheus / metrics scrapers against BE 8040,
monitoring agents, health probes, ops scripts, tooling driving the FE `/api/**`
REST surface — will receive 401 after upgrading and must be given credentials.
As a temporary migration aid the previous behavior can be restored with `ADMIN
SET FRONTENDS CONFIG ("enable_all_http_auth" = "false")` and
`enable_all_http_auth = false` in `be.conf`. FE `/metrics` is unaffected — it
remains public.
### Check List (For Author)
- Test
- [x] Regression test
- [x] Unit Test
- [ ] Manual test (add detailed scripts or steps below)
- [ ] No need to test or manual test. Explain why:
- [ ] This is a refactor/code format and no logic has been changed.
- [ ] Previous test can cover this change.
- [ ] No code files have been changed.
- [ ] Other reason
- Behavior changed:
- [ ] No.
- [x] Yes. FE and BE HTTP interfaces now authenticate by default. See
the release note above.
- Does this need documentation?
- [ ] No.
- [x] Yes. Upgrade guide and the `enable_all_http_auth` config reference
need the default change and the migration steps. Doc PR to follow.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01DQYGBqjpszZrSNKdGnX3Yz
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
