feat(EN-115): Deprecate X-BackendAI-SSO header for pipeline service authentication
#3353
Conversation
github-actions
bot
added
comp:webserver
…353.feature.md Co-authored-by: octodog <mu001@lablup.com>
| if proxy_path == "pipeline" and real_path.rstrip("/") == "login": | ||
| api_rqst.headers["X-BackendAI-SessionID"] = request.headers.get( | ||
| "X-BackendAI-SessionID", "" | ||
| ) |
There was a problem hiding this comment.
I dont' think rqst is a commonly used abbreviation. Would it be possible to rename it?
There was a problem hiding this comment.
Renaming the api_rqst will be a over-scoped task, as the name is used in various modules in this project.
Would you mind if I issue a new ticket for it and proceed in next work?
Thank you.
There was a problem hiding this comment.
Please create the rename task with priority: low and handle it when you have time. :)
There was a problem hiding this comment.
The task will be tracked by BA-469
| if proxy_path == "pipeline": | ||
| session_id = request.headers.get("X-BackendAI-SessionID", "") | ||
| if not (sso_token := request.headers.get("X-BackendAI-SSO")): | ||
| jwt_secret = config["pipeline"]["jwt"]["secret"] | ||
| now = datetime.now().astimezone() | ||
| payload = { | ||
| # Registered claims | ||
| "exp": now + timedelta(seconds=config["session"]["max_age"]), | ||
| "iss": "Backend.AI Webserver", | ||
| "iat": now, | ||
| # Private claims | ||
| "aiohttp_session": session_id, | ||
| "access_key": api_session.config.access_key, # since 23.03.10 | ||
| } | ||
| sso_token = jwt.encode(payload, key=jwt_secret, algorithm="HS256") | ||
| api_rqst.headers["X-BackendAI-SSO"] = sso_token | ||
| api_rqst.headers["X-BackendAI-SessionID"] = session_id |
There was a problem hiding this comment.
How does Fasttrack handle version compatibility?
When making changes this time, is there any risk of breaking functionality for clients using previous versions?
There was a problem hiding this comment.
It is recommended to use the same version as Backend.AI Core.
To enhance version compatibility, we may adopt a dedicated header (e.g., X-BackendAI-FastTrack-Version).
Follow-up of #1350.
This pull request deprecates the JWT-based
X-BackendAI-SSOheader to reduce complexity in authentication process for the pipeline service.Checklist: (if applicable)