{"action":"opened","issue":{"url":"https://api.github.com/repos/dmwm/DDM/issues/63","labels_url":"https://api.github.com/repos/dmwm/DDM/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/dmwm/DDM/issues/63/comments","events_url":"https://api.github.com/repos/dmwm/DDM/issues/63/events","html_url":"https://github.com/dmwm/DDM/issues/63","id":71328395,"number":63,"title":"Verify the request headers coming from the cmsweb frontend ","user":{"login":"nikmagini","id":5758556,"avatar_url":"https://avatars.githubusercontent.com/u/5758556?v=3","gravatar_id":"","url":"https://api.github.com/users/nikmagini","html_url":"https://github.com/nikmagini","followers_url":"https://api.github.com/users/nikmagini/followers","following_url":"https://api.github.com/users/nikmagini/following{/other_user}","gists_url":"https://api.github.com/users/nikmagini/gists{/gist_id}","starred_url":"https://api.github.com/users/nikmagini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nikmagini/subscriptions","organizations_url":"https://api.github.com/users/nikmagini/orgs","repos_url":"https://api.github.com/users/nikmagini/repos","events_url":"https://api.github.com/users/nikmagini/events{/privacy}","received_events_url":"https://api.github.com/users/nikmagini/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dmwm/DDM/labels/Category:%20CRAB%20popularity%20web","name":"Category: CRAB popularity web","color":"006b75"},{"url":"https://api.github.com/repos/dmwm/DDM/labels/Category:%20Victor%20web","name":"Category: Victor web","color":"006b75"},{"url":"https://api.github.com/repos/dmwm/DDM/labels/Category:%20xrootd%20popularity%20web","name":"Category: xrootd popularity web","color":"006b75"},{"url":"https://api.github.com/repos/dmwm/DDM/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-27T15:56:07Z","updated_at":"2015-04-27T15:56:07Z","closed_at":null,"body":"From Diego:\r\n\r\nOne thing that is missing in the setup but is not critical for now is\r\nthat both popdbweb and victorweb are not verifying the headers coming\r\nfrom the cmsweb frontends. Every back-end service must check them to\r\nmake sure requests have not been tampered with or crafted locally by\r\nexploiting some failure in some other service running on the same\r\nback-end. Once  that protection would be in place, we cannot anymore\r\ngenerate requests locally.\r\n\r\nOn a separate note, it is also important all requests pass through the\r\nfrontends for the proper accountability and indentification of all the\r\nclients."}}