Need encryption and authentication on websocket of the connecting user

[jondequinor]

No description provided.

[sondreso]

Talk to the red pandas about their setup

[jondequinor]

Questions to be answered before taking on this task:

• Do we need encryption of the traffic?
• Is authentication personal or group based?
• Can we re-use storage auth work?

[pinkwah]

• You can do off-the-shelf encryption via wss (secure websockets). You don't need encryption on the intranet as only those with root user can snoop and at that point they can just access the data on NFS directly.
• ERT Storage has UNIX file based authentication: Anyone with access to storage_server.json can access the server as this file contains the authentication token. This is okay because those who can access this file can also access all the confidential data on NFS directly.
• Yes please. Do @ me. I have a few ideas to make it nice ™️ wrt. RGS.

For the authentication, assuming you can edit the headers sent by the initial websocket handshake, is to look for X-Token or w/e. Using Flask, you can add a @app.before_request function. With FastAPI, you can just combine their APIKey security scheme with the Websocket route and it should work with minimal hacking.

[jondequinor]

You can do off-the-shelf encryption via wss (secure websockets). You don't need encryption on the intranet as only those with root user can snoop and at that point they can just access the data on NFS directly.

@dotfloat what certs would we use?

Is the storage server using SSL?

[pinkwah]

Nope. We also removed SSL from webviz. Don't need encryption on the intranet.

The alternative is to create certs on the fly. We don't do this because it doesn't fly nicely with browsers, which give you full-page scary warnings about not being able to validate the cert. Having an internal SSL key that is in Equinor's internal CA is also not a solution since sharing a private key between users is the same as not having encryption.

We'll be able to use SSL/WSS when we're in the ☁️ quite easily and transparently. Not a concern now nor will it be in the future imo.