cowboygneox / gandalf Goto Github PK

When hitting the /search endpoint, results only come back in a case sensitive manner

Support for products like Prometheus would be excellent.

There should be configuration for enforcing username and password requirements. Maybe a regex or something?

After a logout, the token will be invalid. If a user reuses the invalid token, they will receive a 401.

Return a payload and status code that emphasizes a timeout.

Lock out an IP after a certain number of attempts over a certain period.

Currently, if you provide an Authorization header with lower case bearer, it will reject the token. Forcing capitalization is unnecessary.

Apparently, passing in a Content-Type of application/x-www-form-urlencoded makes the app fail. This is not by design.

Consistent with Kubernetes documentation:

• /auth/live will return 200 "OK" if the service is responding to any traffic.
• /auth/ready will return 200 "OK" if all service dependencies (postgres, redis) are appropriately connected.

Opening the websocket to Gandalf will be open to the world, but authentication will be required within 2 seconds or the socket will close. To authenticate the socket, the first message sent to the socket will be:

Authentication: Bearer {access_token}

I need to quantify which headers to filter out and document them here.

Regardless if the login succeeds or fails, the timing should be near identical to avoid exposing knowledge of users in the system.

The test coverage is decent, but most of the code exists in a single file due to the injection of the configuration. The codebase could use a pass of cleanup to make the code much more manageable.

Obviously the documentation is lacking. Let's get that in.

Tokens that live forever will just flood our cache, and it makes it easier to bruteforce. We should make a configurable duration that will cleanup tokens.