CSRF Prevention

[ardatan]

Closes #321
Ref ROUTER-114

[gemini-code-assist]

Summary of Changes

Hello @ardatan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security posture of the router by implementing a robust CSRF prevention mechanism. It allows for the configuration of required HTTP headers, which are then validated early in the request pipeline to ensure that incoming requests are legitimate and not part of a Cross-Site Request Forgery attack. This feature provides an essential layer of protection against malicious requests, improving the overall integrity and security of the application.

Highlights

• New CSRF Prevention Mechanism: Introduced a new module csrf_prevention.rs that implements logic to prevent Cross-Site Request Forgery (CSRF) attacks by checking for specific headers in incoming requests.
• Configurable Required Headers: The CSRF prevention mechanism is configurable, allowing users to specify a list of required_headers that must be present in requests. This configuration is defined in lib/router-config/src/csrf.rs and integrated into the main router configuration.
• Pipeline Integration: The CSRF prevention check is integrated early into the request processing pipeline within bin/router/src/pipeline/mod.rs, ensuring that requests are validated before further processing.
• Error Handling: A new error variant PipelineErrorVariant::CsrfPreventionFailed has been added to bin/router/src/pipeline/error.rs, which results in a 403 Forbidden HTTP status code when a CSRF check fails.
• Documentation Update: The docs/README.md has been updated to include detailed information and examples for configuring the new CSRF prevention feature.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces CSRF prevention, a valuable security enhancement. The implementation is mostly solid, adding a new configuration option and integrating the check into the request pipeline. I've provided a few suggestions to improve the efficiency of a header check, and to enhance the clarity of the documentation and code comments. Overall, this is a great addition.

[github-actions]

✅ k6-benchmark results

     ✓ response code was 200
     ✓ no graphql errors
     ✓ valid response structure

     █ setup

     checks.........................: 100.00% ✓ 230367      ✗ 0    
     data_received..................: 6.7 GB  224 MB/s
     data_sent......................: 90 MB   3.0 MB/s
     http_req_blocked...............: avg=3.07µs   min=652ns  med=1.77µs  max=6.51ms   p(90)=2.47µs  p(95)=2.83µs  
     http_req_connecting............: avg=449ns    min=0s     med=0s      max=2.93ms   p(90)=0s      p(95)=0s      
     http_req_duration..............: avg=19.05ms  min=1.88ms med=18.09ms max=79.3ms   p(90)=26.38ms p(95)=29.59ms 
       { expected_response:true }...: avg=19.05ms  min=1.88ms med=18.09ms max=79.3ms   p(90)=26.38ms p(95)=29.59ms 
     http_req_failed................: 0.00%   ✓ 0           ✗ 76809
     http_req_receiving.............: avg=132.82µs min=23.5µs med=38.96µs max=42.47ms  p(90)=88.37µs p(95)=366.47µs
     http_req_sending...............: avg=26.21µs  min=5.53µs med=10.68µs max=44.22ms  p(90)=16.31µs p(95)=28.46µs 
     http_req_tls_handshaking.......: avg=0s       min=0s     med=0s      max=0s       p(90)=0s      p(95)=0s      
     http_req_waiting...............: avg=18.89ms  min=1.82ms med=17.97ms max=68.39ms  p(90)=26.11ms p(95)=29.26ms 
     http_reqs......................: 76809   2555.017033/s
     iteration_duration.............: avg=19.52ms  min=5.53ms med=18.45ms max=208.78ms p(90)=26.87ms p(95)=30.11ms 
     iterations.....................: 76789   2554.351742/s
     vus............................: 50      min=50        max=50 
     vus_max........................: 50      min=50        max=50 

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Image Names: ghcr.io/graphql-hive/router

Platforms: linux/amd64,linux/arm64

Image Tags: ghcr.io/graphql-hive/router:pr-472 ghcr.io/graphql-hive/router:sha-17862fb

Docker metadata

{
"buildx.build.ref": "builder-72104eed-85b0-4575-97e4-3a6f00df8cb8/builder-72104eed-85b0-4575-97e4-3a6f00df8cb80/loclpq9mopm9vsromu8pnumua",
"containerimage.descriptor": {
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "digest": "sha256:ba0b74d763b281dc91c6dc5ef9a47469cdeb859093ec547977b597e4c4b7416e",
  "size": 1609
},
"containerimage.digest": "sha256:ba0b74d763b281dc91c6dc5ef9a47469cdeb859093ec547977b597e4c4b7416e",
"image.name": "ghcr.io/graphql-hive/router:pr-472,ghcr.io/graphql-hive/router:sha-17862fb"
}