Protect console access via AWS Cognito (and possibly other similar tools)

[scare21410]

I would like to use AWS Cognito to take care of logging users, MFA, managing user pools etc.

Cognito works by intercepting any requests to the app, checking cookies to see if user is logged in and if not, redirecting to login form, then redirecting back to the app.

Unfortunately, any request to /v1/query fails because of globalCookiePolicy being set to 'omit', making Cognito redirect the request to the login form.

So I think we could add some environment variable e.g. HASURA_COOKIE_POLICY to override the default setting.

Additionally, when using Cognito, I don't want to be forced to set admin secret even in production. I would suggest adding another option, e.g. HASURA_GRAPHQL_ADMIN_SECRET_DISABLED to make it possible to disable admin secret even in production.

I think this is pretty easy change to make and I will be happy to provide PR, if we agree on environment variable names.

I'm sure there are other tools that work like AWS Cognito, so this would fix it for every of them.

Possibly related: #2722

[esteiner]

We have the same issue when using Keycloak (instead of AWS Cognito) and its Gatekeeper in front of every application, because the kc_access cookie is not sent for /v1/query fetch requests because of Actions.js#98:

  const url = Endpoints.serverConfig;
  const options = {
    method: 'GET',
    credentials: globalCookiePolicy,
    headers: getState().tables.dataHeaders,
  };

with globalCookiePolicy set to 'omit'.

[dsandip]

@scare21410 @esteiner Would love to discuss this in more detail and run some of our plans by you. Could you please help with setting up a chat using this.

[tirumaraiselvan]

@rikinsk Can you review this task?

@scare21410 Happy to have a PR from you, could you also point to other kinds of cookie policies and how they might affect this? (Basically some kind of spec level info)

[philip-wigg-qatalog]

We're also affected by this issue. We can't log into the admin console when Hasura is fronted by Google Identity Aware Proxy (IAP).

[rikinsk]

The following PR #4336 should fix the issue of the console not sending cookies with API calls.

This issue can be used to track the other proposed ideas.

[Nohac]

Is there any updates on adding the possibility to disable the admin token? There's no reason in having an admin token in production as it would be terrible if it got leaked.