feat: ignore other auth prefixes

[lleadbet]

This PR enables the JWT plugin to ignore other auth prefixes other than the one defined in the configuration. As to not break existing uses, this is defaulting to be false.

This enables multiple Authorization schemes to be supported, although other schemes would need to be handled in either Rhai or a coprocessor to be used with the AuthN plugin.

---

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Tests added and passing³
  • Unit Tests
  • Integration Tests
  • Manual Tests

Exceptions

Empty prefixes will not be affected by this change as there is no prefix to ignore.

Notes

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[router-perf]

CI performance tests

• reload - Reload test over a long period of time at a constant rate of users
• events_big_cap_high_rate_callback - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity using callback mode
• events_without_dedup_callback - Stress test for events with a lot of users and deduplication DISABLED using callback mode
• large-request - Stress test with a 1 MB request payload
• const - Basic stress test that runs with a constant number of users
• no-graphos - Basic stress test, no GraphOS.
• step-jemalloc-tuning - Clone of the basic stress test for jemalloc tuning
• events - Stress test for events with a lot of users and deduplication ENABLED
• events_callback - Stress test for events with a lot of users and deduplication ENABLED in callback mode
• events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• xxlarge-request - Stress test with 100 MB request payload
• xlarge-request - Stress test with 10 MB request payload
• step - Basic stress test that steps up the number of users over time

[garypen]

Most of my comments are NITS or advisory. One thing that bothers me though.

If this option exists and is set to true, doesn't that mean that an attacker could bypass JWT authentication by simply setting another prefix? I know that the burden of responsibility then lies on the user to perform that authentication, but it still bothers me that the config is providing this open door as part of our JWT scheme. I feel like we need to document somewhere in big RED LETTERS what the implications of using this are.

[lleadbet]

If this option exists and is set to true, doesn't that mean that an attacker could bypass JWT authentication by simply setting another prefix? I know that the burden of responsibility then lies on the user to perform that authentication, but it still bothers me that the config is providing this open door as part of our JWT scheme. I feel like we need to document somewhere in big RED LETTERS what the implications of using this are.

I agree. It's definitely a fine line to tread, but some folks do bearer for jwts, basic for token-based, or any mix.

If we could in the future have the plugin do auth schemes based on prefixes (e.g. bearer is now the JWT plugin) that might solve for some of the concern.

And to be honest- the changing of headers would still be applicable for any other system that does auth. We (SAs) still highly recommend validating the token in the subgraph regardless.

Going to flag up to sec and see what they say, however.

[Geal]

I'm not sure we actually need an option. The router looks for the value with the prefix it needs, it ignores the rest, we still have the same behavior as before: if it does not find the value it wants, then the request will not be authenticated

[garypen]

Is that right? I thought we returned an InvalidPrefix message if we didn't recognise a prefix and that's what Lucas is changing. i.e.: what was an Invalid prefix fail will become, with this option enabled, continue.

[Geal]

the important part is whether require_authentication is enabled