You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Through experimentation with authenticated requests through the gateway to the gRPC server, it was found that this gateway does not forward HTTP headers via gRPC Context Metadata as the grpc-gateway does.
This is a massive shortcoming due to the general requirement that authorization and other header analysis should be performed at the gRPC service instance or at the very least with gRPC middleware.
Examining the grpc-gateway's implementation, it appears that all predefined HTTP headers are prepended with the grpcgateway- prefix, likely because these can and will be passed along in standard gRPC requests. Additionally, any custom headers beyond the predefined HTTP ones must be prepended with Grpc-Metadata- during the REST request to the gateway and the prefix will be removed before appending the header and its value to the gRPC context metadata.
It would be nice to simply add grpc-gateway as a dependency to this library to be able to make use of what it already has available, but the code is dependent on set up outside of the AnnotateContext function which would make it impossible to use out of the box and importing it would make for a weird dependency tree.
Instead, the code available in grpc-gateway should be used as inspiration in creating a custom HTTP header forwarding solution for the grpc-graphql-gateway.
The text was updated successfully, but these errors were encountered:
Through experimentation with authenticated requests through the gateway to the gRPC server, it was found that this gateway does not forward HTTP headers via gRPC Context Metadata as the grpc-gateway does.
This is a massive shortcoming due to the general requirement that authorization and other header analysis should be performed at the gRPC service instance or at the very least with gRPC middleware.
Examining the grpc-gateway's implementation, it appears that all predefined HTTP headers are prepended with the
grpcgateway-
prefix, likely because these can and will be passed along in standard gRPC requests. Additionally, any custom headers beyond the predefined HTTP ones must be prepended withGrpc-Metadata-
during the REST request to the gateway and the prefix will be removed before appending the header and its value to the gRPC context metadata.It would be nice to simply add grpc-gateway as a dependency to this library to be able to make use of what it already has available, but the code is dependent on set up outside of the
AnnotateContext
function which would make it impossible to use out of the box and importing it would make for a weird dependency tree.Instead, the code available in grpc-gateway should be used as inspiration in creating a custom HTTP header forwarding solution for the grpc-graphql-gateway.
The text was updated successfully, but these errors were encountered: