The Wayback Machine - https://web.archive.org/web/20201013035006/https://github.com/cube-js/cube.js/issues/835
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make base route output configurable #835

Open
tobilg opened this issue Jul 14, 2020 · 7 comments
Open

Make base route output configurable #835

tobilg opened this issue Jul 14, 2020 · 7 comments

Comments

@tobilg
Copy link

@tobilg tobilg commented Jul 14, 2020

Is your feature request related to a problem? Please describe.
It would be great to be able to configure the route output, e.g. I want to hide the Cube.js server is running in production mode. Learn more about production mode. when the base route is hit

Describe the solution you'd like
I think it would be great if one could configure the output of https://github.com/cube-js/cube.js/blob/master/packages/cubejs-server-core/core/index.js#L398 when the core server is instantiated.

@paveltiunov
Copy link
Contributor

@paveltiunov paveltiunov commented Jul 15, 2020

@tobilg Hey Tobi! Thanks for posting it! Are you're trying to override the / path but Cube.js takes precedence in it?

@tobilg
Copy link
Author

@tobilg tobilg commented Jul 20, 2020

@paveltiunov Basically I just want to hide that the endpoint is running Cube.js to external users. I know security by obscurity isn't the best idea, but ideally I'd like to give as litte info to potential attackers as possible.

@paveltiunov
Copy link
Contributor

@paveltiunov paveltiunov commented Jul 27, 2020

@tobilg We'd need to handle this / route as an error if it isn't defined by user then. So you'd be able to implement your own which always will take precedence.

@KarateCowboy
Copy link

@KarateCowboy KarateCowboy commented Jul 29, 2020

How about the option for a base route message?, eg:

const dbType = 'mysql';
const options = {
  dbType,
  devServer: false,
  prodBaseUrlMsg: 'Nothing here',
  logger: (msg, params) => {
    console.log(`${msg}: ${JSON.stringify(params)}`);
  },
  schemaPath: path.join('assets', 'schema')
};

const core = CubejsServerCore.create(options);

It could be assigned in the contstructor:

    this.logger = options.logger ||
      (process.env.NODE_ENV !== 'production' ?
        devLogger(process.env.CUBEJS_LOG_LEVEL) :
        prodLogger(process.env.CUBEJS_LOG_LEVEL)
      );
    this.prodBaseUrlMessage = options.prodBaseUrlMessage || `Cube.js server is running in production mode. <a href="https://cube.dev/docs/deployment#production-mode">Learn more about production mode</a>.`  
    this.repository = new FileRepository(this.schemaPath);

Then changes in initApp eg:

  async initApp(app) {
    checkEnvForPlaceholders();
    const apiGateway = this.apiGateway();
    apiGateway.initApp(app);
    if (this.options.devServer) {
      this.devServer.initDevEnv(app);
    } else {
      app.get('/', (req, res) => {
        res.status(200)
          .send(`<html><body>${this.prodBaseUrlMessage}</body></html>`);
      });
    }
  
@jcw- jcw- mentioned this issue Aug 1, 2020
2 of 4 tasks complete
@KarateCowboy
Copy link

@KarateCowboy KarateCowboy commented Aug 5, 2020

Hey so.... I don't even use Cube.js, and just decided it was a cool project and I'd try my hand at volunteering. Never really done that for OSS before. Is it normal in the world of OSS to dedicate a whole week night of your time, for free, to familiarizing yourself with a project, issue and propose a solution, only to be completely ignored, and have some other guy like @jcw- swoop in and piss all over your efforts? Because it sure is frustrating. I would have thought that whole "Showing empathy toward other community members" in your CoC would preclude something like that from happening. But, maybe I'm just new and all that empathy talk is lip service, and throwing away half a work day like that is normal in the jungle of OSS and I need to just suck it up.

@jcw-
Copy link
Contributor

@jcw- jcw- commented Aug 5, 2020

@KarateCowboy It is a cool project - you should also check out the Slack workspace! Thanks for taking the time to discuss approaches to this feature. I've also been thinking about ways to accomplish this and should have tagged you on the PR - I'm not sure if linking to the issue was enough to give you a notification. Even though your approach isn't the way I went in my PR, I did read and think about your suggestion and consider it a valuable contribution to the topic. Sorry for your frustration!

Regarding your approach, here's some thoughts:

  • you cover all the configuration pieces well, I think it's a good option for customizing the message
  • in addition to a config option, sometimes its useful to also support an env var override, I'm not sure if that would be particularly useful here, as it's probably more of a one-time config, but curious if you considered it
  • it is typical in production hardening to not emit these kinds of messages, as they make it easier to fingerprint services, a sentiment I think the issue author is expressing when they say "give as litte info to potential attackers as possible", so to that end, it would be ideal to not even respond to this route at all, so an approach that not only allows full configuration of response, but allows allows no response at all (e.g. a 404) could be considered a more flexible approach
@KarateCowboy
Copy link

@KarateCowboy KarateCowboy commented Aug 5, 2020

@jcw- Thank you for your input. It's good to know that my efforts produced some fruit, even if just food for someone else to consider in his approach. Also, thank you for your insights. I can now say I'm satisfied.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
You can’t perform that action at this time.