Uh oh!
There was an error while loading. Please reload this page.
[Enhancement](http)Add http authentication to all API interfaces under be 8040. - #39577
Merged
Conversation
doris-robot
commented
Aug 19, 2024
Thank you for your contribution to Apache Doris. Since 2024-03-18, the Document has been moved to doris-website. |
hubgeter
commented
Aug 19, 2024
ContributorAuthor
run buildall |
doris-robot
commented
Aug 19, 2024
TPC-H: Total hot run time: 38235 ms |
doris-robot
commented
Aug 19, 2024
TPC-DS: Total hot run time: 190943 ms |
doris-robot
commented
Aug 19, 2024
ClickBench: Total hot run time: 32.02 s |
hubgeter
commented
Aug 20, 2024
ContributorAuthor
run buildall |
doris-robot
commented
Aug 20, 2024
TPC-H: Total hot run time: 38549 ms |
doris-robot
commented
Aug 20, 2024
TPC-DS: Total hot run time: 191411 ms |
doris-robot
commented
Aug 20, 2024
ClickBench: Total hot run time: 31.7 s |
hubgeterforce-pushed
the
enable_be_http_auth
branch
from
August 20, 2024 13:59
88969e7 to
7557f21Comparehubgeterforce-pushed
the
enable_be_http_auth
branch
from
August 20, 2024 14:06
7557f21 to
9877411Comparehubgeter
commented
Aug 20, 2024
ContributorAuthor
run buildall |
Contributor
clang-tidy review says "All clean, LGTM! 👍" |
| ASSERT_TRUE(check_result(input_G, output_G)); | ||
| } | ||
| TEST_F(HttpClientTest, enable_http_auth) { |
Contributor
There was a problem hiding this comment.
warning: function 'TEST_F' exceeds recommended size/complexity thresholds [readability-function-size]
TEST_F(HttpClientTest, enable_http_auth) {
^Additional context
be/test/http/http_client_test.cpp:347: 194 lines including whitespace and comments (threshold 80)
TEST_F(HttpClientTest, enable_http_auth) {
^doris-robot
commented
Aug 20, 2024
TPC-H: Total hot run time: 38288 ms |
doris-robot
commented
Aug 20, 2024
TPC-DS: Total hot run time: 191574 ms |
doris-robot
commented
Aug 20, 2024
ClickBench: Total hot run time: 30.75 s |
hubgeter
commented
Aug 21, 2024
ContributorAuthor
run buildall |
doris-robot
commented
Aug 21, 2024
TPC-H: Total hot run time: 38190 ms |
doris-robot
commented
Aug 21, 2024
TPC-DS: Total hot run time: 191161 ms |
doris-robot
commented
Aug 21, 2024
ClickBench: Total hot run time: 30.73 s |
Contributor
PR approved by at least one committer and no changes requested. |
Contributor
PR approved by anyone and no changes requested. |
zy-kkk
approved these changes
Aug 23, 2024
dataroaring pushed a commit
that referenced
this pull request
Aug 26, 2024
…r be 8040. (#39577) Add http authentication to all API interfaces under be 8040 The `enable_all_http_auth parameter` in be.conf can control the switch.
morningman pushed a commit
that referenced
this pull request
Aug 29, 2024
## Proposed changes before pr #39577
hubgeter added a commit
to hubgeter/doris
that referenced
this pull request
Aug 29, 2024
## Proposed changes before pr apache#39577
yiguolei pushed a commit
that referenced
this pull request
Aug 29, 2024
dataroaring pushed a commit
that referenced
this pull request
Sep 3, 2024
## Proposed changes before pr #39577
Closed
16 tasks
morningman added a commit
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: #39577 Problem Summary: In #39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
github-actionsBot
pushed a commit
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: #39577 Problem Summary: In #39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
zzzxl1993 pushed a commit
to zzzxl1993/doris
that referenced
this pull request
Nov 12, 2024
### What problem does this PR solve? Related PR: apache#39577 Problem Summary: In apache#39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
py023 pushed a commit
to py023/doris
that referenced
this pull request
Nov 13, 2024
### What problem does this PR solve? Related PR: apache#39577 Problem Summary: In apache#39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
HappenLee pushed a commit
to HappenLee/incubator-doris
that referenced
this pull request
Apr 24, 2026
…r be 8040. (apache#39577) Add http authentication to all API interfaces under be 8040 The `enable_all_http_auth parameter` in be.conf can control the switch.
HappenLee pushed a commit
to HappenLee/incubator-doris
that referenced
this pull request
Apr 24, 2026
## Proposed changes before pr apache#39577
HappenLee pushed a commit
to HappenLee/incubator-doris
that referenced
this pull request
Apr 24, 2026
### What problem does this PR solve? Related PR: apache#39577 Problem Summary: In apache#39577, we added the auth check for all HTTP API on FE side. But it introduced an issue that when `enable_all_http_auth`, the internal http request will fail due to lack of authentication info. For example, when cloning replica from one BE to another, it use HTTP API. This PR mainly changes: 1. Unify the token generation and checking logic Move `TokenManager` from `load` package to `Env`, as a global mgr. It is responsible for generating tokens at fix interval. And the token will be sent to BE via heartbeat. BE will save last 2 tokens, and use the latest token in HTTP request. All HTTP request sent by BE will add a header `Auth-Token`, and BE's HTTP server will check if this token in header is same as token from FE heartbeat. 2. Add a new class `ClusterInfo` on BE side to replace `TMasterInfo`. `TMasterInfo` is a thrift object used to save master info and pass them from FE to BE via heartbeat. So it should only be a message payload, we should get info from it and save it in another structure: `ClusterInfo`. Co-authored-by: morningman <yunyou@selectdb.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Add http authentication to all API interfaces under be 8040
The
enable_all_http_auth parameterin be.conf can control the switch.Issue Number: close #xxx