From f3012e652edef614d4f0ed169b320106a85d83b3 Mon Sep 17 00:00:00 2001 From: omnom62 Date: Wed, 5 Aug 2026 09:14:32 +1000 Subject: http-api: T8989: add REST Bearer token authentication Add JWT Bearer token support to the REST API, as an additional authentication method alongside the existing form-field key and X-API-Key header. - New POST /token endpoint mints a JWT for a valid API key - auth_required() accepts Authorization: Bearer alongside existing key/X-API-Key auth - New config nodes: service https api rest authentication {expiration, secret-length} (defaults: 3600s / 32 bytes) - REST tokens use an independent signing secret from GraphQL's, since GraphQL may not be enabled on all deployments and the two subsystems have different expiry requirements - nginx location regex updated to allow /token - service_https.py default-value merge generalized to also apply to the rest node, not just graphql, so REST authentication defaults populate correctly on commit --- src/services/vyos-http-api-server | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/services/vyos-http-api-server') diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server index 94697ed4d..4039d17a2 100755 --- a/src/services/vyos-http-api-server +++ b/src/services/vyos-http-api-server @@ -184,6 +184,9 @@ def initialization(session: SessionState, app: FastAPI = app): rest_config = server_config.get('rest', {}) session.debug = bool('debug' in rest_config) session.strict = bool('strict' in rest_config) + if isinstance(rest_config, dict) and 'authentication' in rest_config: + session.rest_token_exp = rest_config['authentication']['expiration'] + session.rest_secret_len = rest_config['authentication']['secret_length'] graphql_config = server_config.get('graphql', {}) session.origins = graphql_config.get('cors', {}).get('allow_origin', []) -- cgit v1.2.3