Skip to content

Fix broken 'src lsif upload' inside executor due to basic auth removal

Administrator requested to merge mrn/auth-header-executor into main

Created by: mrnugget

In #29885 we removed basic auth from the executor (and its counterpart in Sourcegrap, the executorqueue).

We replaced it with Authorization header based authentication due to customer feedback.

What we forgot: we also used basic auth for the internal LSIF upload endpoint that's used by src inside executor.

On the src side:

  1. We set username/password by modifying the SRC_ENDPOINT: https://github.com/sourcegraph/sourcegraph/blob/cdd762da77261e5d007ece56cfa51bef628aeb62/enterprise/cmd/frontend/internal/executorqueue/queues/codeintel/transform.go#L39-L42
  2. We tell src to use the internal upload handler: https://github.com/sourcegraph/sourcegraph/blob/cdd762da77261e5d007ece56cfa51bef628aeb62/enterprise/cmd/frontend/internal/executorqueue/queues/codeintel/transform.go#L72

On the server side:

  1. We protect the /lsif/upload route with the same auth middleware that we use for other executor<->Sourcegraph communication: https://github.com/sourcegraph/sourcegraph/blob/899643f29b1e88170e984c8946d322f6ca2c7bc1/enterprise/cmd/frontend/internal/executorqueue/queuehandler.go#L42-L44

The last point is what we forgot when we changed the middleware in #29885.

So, the fix here is to tell src to authenticate via the Authorization: header too.

Merge request reports

Loading