- Notifications
You must be signed in to change notification settings - Fork0
A plugin for Envoy, written in Rust, that implements basic authentication and stores it in an encrypted cookie to persist across browser sessions.
License
NotificationsYou must be signed in to change notification settings
antonengelhardt/basic-auth-plugin
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
A proxy-wasm plugin for Envoy that implements basic authentication. Allowed users can pass through and access the service. The authorization is stored in an encrypted cookie which makes it persistent across sessions.
For developing theRust Toolchain has to be installed and the WASM target has to be enabled. E.g. for Ubuntu this can be achieved by:
# Install Build essentialsapt install build-essential# Install Rustupcurl --proto'=https' --tlsv1.2 -sSf https://sh.rustup.rs| sh# Enable WASM compilation targetcargo build --target wasm32-wasip1 --release
Shortcut (make sure to havemake installed):
make run
- Building the plugin:
cargo build --target wasm32-wasip1 --release# ormake build- Testing locally with Envoy (docker anddocker-compose are needed):
docker compose up
- Requests to the locally running envoy with the plugin enabled:
curl localhost:10000
The plugin is configured via theenvoy.yaml-file. The following configuration options are required:
| Name | Type | Description | Example | Required |
|---|---|---|---|---|
allowed_users | Object | A list of allowed username/password combinations. | See below | ✅ |
cookie_name | String | Name of the Session and Nonce cookie. | basic-auth-session | ✅ |
cookie_duration | u64 | A number of seconds that the cookie should live for. | 86400 | ✅ |
aes_key | String | A base64-encoded AES-Key of 32 bits, generate withopenssl rand -base64 32 | g00nv8nuZfNrqc99OKUOqCCatepmscgSeX70nYq4Xdo= | ✅ |
Theallowed_users key expects a list of username/password combinations, like so:
allowed_users: -username:user1password:password123