diff options
| author | omnom62 <omnom62@outlook.com> | 2026-08-05 09:14:32 +1000 |
|---|---|---|
| committer | John Estabrook <jestabro@vyos.io> | 2026-08-26 13:33:34 -0500 |
| commit | f3012e652edef614d4f0ed169b320106a85d83b3 (patch) | |
| tree | a832563e49b79115497a078f98a748ef2e368113 /interface-definitions/service_https.xml.in | |
| parent | d2b54b9d01aee583a80a0cd48a790843d8c85b76 (diff) | |
| download | vyos-1x-f3012e652edef614d4f0ed169b320106a85d83b3.tar.gz vyos-1x-f3012e652edef614d4f0ed169b320106a85d83b3.zip | |
http-api: T8989: add REST Bearer token authentication
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
Diffstat (limited to 'interface-definitions/service_https.xml.in')
| -rw-r--r-- | interface-definitions/service_https.xml.in | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/interface-definitions/service_https.xml.in b/interface-definitions/service_https.xml.in index 7bb63fa5a..f576444e9 100644 --- a/interface-definitions/service_https.xml.in +++ b/interface-definitions/service_https.xml.in @@ -50,6 +50,39 @@ <hidden/> </properties> </leafNode> + <node name="authentication"> + <properties> + <help>REST authentication</help> + </properties> + <children> + <leafNode name="expiration"> + <properties> + <help>Token time to expire in seconds</help> + <valueHelp> + <format>u32:60-31536000</format> + <description>Token lifetime in seconds</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 60-31536000"/> + </constraint> + </properties> + <defaultValue>3600</defaultValue> + </leafNode> + <leafNode name="secret-length"> + <properties> + <help>Length of shared secret in bytes</help> + <valueHelp> + <format>u32:16-65535</format> + <description>Byte length of generated shared secret</description> + </valueHelp> + <constraint> + <validator name="numeric" argument="--range 16-65535"/> + </constraint> + </properties> + <defaultValue>32</defaultValue> + </leafNode> + </children> + </node> </children> </node> <node name="graphql"> |