Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

all: support proxy of twilio base urls #98

Conversation

expertonium
Copy link

Adds support for proxying calls through a specific outbound server.

Adds support for proxying calls through a specific outbound server.
@kevinburke
Copy link
Owner

Thanks for this. I'm a bit nervous about this since it might make extracting tokens easier - if you can figure out how to set an env var in someone's environment you could get them to send traffic to a totally different host without their expecting that. Maybe that's a dumb thing to worry about.

@kevinburke
Copy link
Owner

How about a new method SetURLsFromEnv() that you can call to override BaseURL, MonitorURL etc based on the env vars you have picked out?

@expertonium
Copy link
Author

expertonium commented Oct 21, 2023

Yeah, I hear you 100% about concerns with cross-contamination within a container where someone isn't aware of the implications, or perhaps even the fact of, Something Else setting/overriding global ENV vars in such a way as proxies Twilio data Somewhere Else.

Setters make sense to me.

I confess, it's an inconvenience, because with env vars I can just set them on a container, and then fill-in-the-blank application using your package just works. In this case Zitadel, where I'm presently doing a replace with the PR at issue here:
zitadel/zitadel@9840e27

Zitadel and others like it might be best served by an actual Admin UI Field that allows override of the Twilio base url, and thereby uses the Setters you're describing, in a highly intentional, well-communicated way.

Anyway, it all hinges on your notion of Container Security and who is responsible for it, with the context that your module is included in other open-source projects in a big way.

@expertonium expertonium closed this by deleting the head repository Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants