Main Page » Mailing List » March 2016

REST-Interface /Openshift/ Security

Monday, 28 March 2016 · 3 messages · last reply 29 Mar 2016
GD
Günter Dunz-Wolff28 Mar 2016 17:14 #
Hi all, I'm in the beginning of a BaseX basexhttp installation on OpenShift. I'm using Openshift quick start for BaseX from Andy Bunce. For my tests, I'm working with a simple factbook-db. Everything is working, but I can't figure out, how to protect the database to be deleted via the REST-Interface: With a simple curl -i -X DELETE "http://xxx-xxx.rhcloud.com/rest/factbook" the Database is dropped. In the database, there is only the user admin. In web.xml the REST-servlet is configured with
<servlet>
    <servlet-name>REST</servlet-name>
    <servlet-class>org.basex.http.rest.RESTServlet</servlet-class>
    <init-param>
      <param-name>org.basex.user</param-name>
      <param-value>admin</param-value>
    </init-param>
    <init-param>
      <param-name>org.basex.password</param-name>
      <param-value>xxx</param-value>
    </init-param>
</servlet>

<servlet-mapping>
    <servlet-name>REST</servlet-name>
    <url-pattern>/rest/*</url-pattern>
</servlet-mapping>
What part of the security-management am I missing? Thanks a lot for any help. Best regards, Günter Dunz-Wolff
AB
Andy Bunce28 Mar 2016 17:39 #
Hi Günter, As supplied Openshift BaseX quick start has REST and Webdav disabled. [1] which avoids any potential security issues via these routes. I would expect your config to require [2]: curl -i -X DELETE "http://admin:xxx at xxx-xxx.rhcloud.com/rest/factbook" Can you get the same behaviour with a local BaseX installation? /Andy [1] https://github.com/Quodatum/openshift-basex-quick-start/blob/master/basex/webapp/WEB-INF/web.xml#L80 [2] http://docs.basex.org/wiki/Web_Application#User_Management
Quoted text · Günter Dunz-Wolff · 40 lines
On 28 March 2016 at 16:14, Günter Dunz-Wolff <kleist at mail.dunzwolff.de> wrote: > Hi all, > > I'm in the beginning of a BaseX basexhttp installation on OpenShift. I'm > using Openshift quick start for BaseX from Andy Bunce. For my tests, I'm > working with a simple factbook-db. Everything is working, but I can't > figure out, how to protect the database to be deleted via the > REST-Interface: > > With a simple curl -i -X DELETE "http://xxx-xxx.rhcloud.com/rest/factbook" > the Database is dropped. > > In the database, there is only the user admin. In web.xml the REST-servlet > is configured with > > <servlet> > <servlet-name>REST</servlet-name> > <servlet-class>org.basex.http.rest.RESTServlet</servlet-class> > <init-param> > <param-name>org.basex.user</param-name> > <param-value>admin</param-value> > </init-param> > <init-param> > <param-name>org.basex.password</param-name> > <param-value>xxx</param-value> > </init-param> > </servlet> > > <servlet-mapping> > <servlet-name>REST</servlet-name> > <url-pattern>/rest/*</url-pattern> > </servlet-mapping> > > What part of the security-management am I missing? Thanks a lot for any > help. > > Best regards, > Günter Dunz-Wolff >
GD
Günter Dunz-Wolff29 Mar 2016 13:54 #
Hi Andy, thanks for your response. My local BaseX installation works as expected: curl -i -X DELETE "http://localhost/rest/factbook" responds with Access denied. Users and Permissions on localhost and OpenShift are identical, in my opinion. As I've written, I had to activate REST in web.xml, because I'm planning to do AJAX-Calls to the OpenShift-Server. I'm in the beginning of transferring my BaseX-Installation to OpenShift. So far, I have no idea, how to transfer my xml-data and xq-files to the OpenShift-Server (hundreds of files). How can I install them on OpenShift, so that BaseX can find them in the correct db- and web-path directories? Sorry, but my technical background is limited. Best regards, Günter
Quoted text · Andy Bunce · 50 lines
> Am 28.03.2016 um 17:39 schrieb Andy Bunce <bunce.andy at gmail.com>: > > Hi Günter, > > As supplied Openshift BaseX quick start has REST and Webdav disabled. [1] which avoids any potential security issues via these routes. > I would expect your config to require [2]: > curl -i -X DELETE "http://admin:xxx at xxx-xxx.rhcloud.com/rest/factbook" > > Can you get the same behaviour with a local BaseX installation? > > /Andy > > [1] https://github.com/Quodatum/openshift-basex-quick-start/blob/master/basex/webapp/WEB-INF/web.xml#L80 > [2] http://docs.basex.org/wiki/Web_Application#User_Management > > > > > On 28 March 2016 at 16:14, Günter Dunz-Wolff <kleist at mail.dunzwolff.de> wrote: > Hi all, > > I'm in the beginning of a BaseX basexhttp installation on OpenShift. I'm using Openshift quick start for BaseX from Andy Bunce. For my tests, I'm working with a simple factbook-db. Everything is working, but I can't figure out, how to protect the database to be deleted via the REST-Interface: > > With a simple curl -i -X DELETE "http://xxx-xxx.rhcloud.com/rest/factbook" the Database is dropped. > > In the database, there is only the user admin. In web.xml the REST-servlet is configured with > > <servlet> > <servlet-name>REST</servlet-name> > <servlet-class>org.basex.http.rest.RESTServlet</servlet-class> > <init-param> > <param-name>org.basex.user</param-name> > <param-value>admin</param-value> > </init-param> > <init-param> > <param-name>org.basex.password</param-name> > <param-value>xxx</param-value> > </init-param> > </servlet> > > <servlet-mapping> > <servlet-name>REST</servlet-name> > <url-pattern>/rest/*</url-pattern> > </servlet-mapping> > > What part of the security-management am I missing? Thanks a lot for any help. > > Best regards, > Günter Dunz-Wolff >

Written for BaseX 8.4. BaseX may have changed since: please check the current documentation.

« detection of external variablesBaseX optimizer performance on REx-generated parser »
⚡Generated with XQuery