diff --git a/CHANGELOG.md b/CHANGELOG.md index b52223031..56fb3b9ce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ This project adheres to [Semantic Versioning](http://semver.org/). ### Removed - API versioning feature - @calebmer - `--db-x` command line arguments - @calebmer +- Remove secure flag - @calebmer ### Fixed - Tolerate a missing role in user creation - @calebmer diff --git a/src/PostgREST/Config.hs b/src/PostgREST/Config.hs index 54d9dcb0e..a83ae50b9 100644 --- a/src/PostgREST/Config.hs +++ b/src/PostgREST/Config.hs @@ -38,7 +38,6 @@ data AppConfig = AppConfig { , configPort :: Int , configAnonRole :: String , configSchema :: String - , configSecure :: Bool , configJwtSecret :: String , configPool :: Int } @@ -49,8 +48,7 @@ argParser = AppConfig <*> option auto (long "port" <> short 'p' <> help "port number on which to run HTTP server" <> metavar "PORT" <> value 3000 <> showDefault) <*> strOption (long "anonymous" <> short 'a' <> help "postgres role to use for non-authenticated requests" <> metavar "ROLE") - <*> strOption (long "schema" <> short 'S' <> help "schema to use for API routes" <> metavar "NAME" <> value "1" <> showDefault) - <*> switch (long "secure" <> short 's' <> help "redirect all requests to HTTPS") + <*> strOption (long "schema" <> short 's' <> help "schema to use for API routes" <> metavar "NAME" <> value "1" <> showDefault) <*> strOption (long "jwt-secret" <> short 'j' <> help "secret used to encrypt and decrypt JWT tokens" <> metavar "SECRET" <> value "secret" <> showDefault) <*> option auto (long "pool" <> short 'o' <> help "max connections in database pool" <> metavar "COUNT" <> value 10 <> showDefault) diff --git a/src/PostgREST/Main.hs b/src/PostgREST/Main.hs index 7dc0540e0..311e895cc 100644 --- a/src/PostgREST/Main.hs +++ b/src/PostgREST/Main.hs @@ -46,8 +46,6 @@ main = do conf <- readOptions let port = configPort conf - unless (configSecure conf) $ - putStrLn "WARNING, running in insecure mode, auth will be in plaintext" unless ("secret" /= configJwtSecret conf) $ putStrLn "WARNING, running in insecure mode, JWT secret is the default value" Prelude.putStrLn $ "Listening on port " ++ @@ -57,7 +55,7 @@ main = do appSettings = setPort port . setServerName (cs $ "postgrest/" <> prettyVersion) $ defaultSettings - middle = logStdout . defaultMiddle (configSecure conf) + middle = logStdout . defaultMiddle poolSettings <- maybe (fail "Improper session settings") return $ H.poolSettings (fromIntegral $ configPool conf) 30 diff --git a/src/PostgREST/MainTest.hs b/src/PostgREST/MainTest.hs index 89a2397c9..55ebec5bc 100644 --- a/src/PostgREST/MainTest.hs +++ b/src/PostgREST/MainTest.hs @@ -54,8 +54,6 @@ main = do conf <- readOptions let port = configPort conf - unless (configSecure conf) $ - putStrLn "WARNING, running in insecure mode, auth will be in plaintext" unless ("secret" /= configJwtSecret conf) $ putStrLn "WARNING, running in insecure mode, JWT secret is the default value" Prelude.putStrLn $ "Listening on port " ++ @@ -65,7 +63,7 @@ main = do appSettings = setPort port . setServerName (cs $ "postgrest/" <> prettyVersion) $ defaultSettings - middle = logStdout . defaultMiddle (configSecure conf) + middle = logStdout . defaultMiddle poolSettings <- maybe (fail "Improper session settings") return $ H.poolSettings (fromIntegral $ configPool conf) 30 diff --git a/src/PostgREST/Middleware.hs b/src/PostgREST/Middleware.hs index 5787ca3a2..cc9fb3fa8 100644 --- a/src/PostgREST/Middleware.hs +++ b/src/PostgREST/Middleware.hs @@ -4,20 +4,15 @@ module PostgREST.Middleware where import Data.Maybe (fromMaybe, isNothing) -import Data.Monoid import Data.Text import Data.String.Conversions (cs) import qualified Hasql as H import qualified Hasql.Postgres as P -import Network.HTTP.Types.Header (hAccept, hAuthorization, - hLocation) -import Network.HTTP.Types.Status (status301, status400, status415) -import Network.URI (URI (..), parseURI) -import Network.Wai (Application, Request (..), - Response, isSecure, rawPathInfo, - rawQueryString, requestHeaders, - responseLBS) +import Network.HTTP.Types.Header (hAccept, hAuthorization) +import Network.HTTP.Types.Status (status415) +import Network.Wai (Application, Request (..), Response, + requestHeaders, responseLBS) import Network.Wai.Middleware.Cors (cors) import Network.Wai.Middleware.Gzip (def, gzip) import Network.Wai.Middleware.Static (only, staticPolicy) @@ -54,27 +49,6 @@ runWithClaims conf app req = do else setRole anon : jwtEnv jwtEnv = claimsToSQL claims -redirectInsecure :: Application -> Application -redirectInsecure app req respond = do - let hdrs = requestHeaders req - host = lookup "host" hdrs - uriM = parseURI . cs =<< mconcat [ - Just "https://", - host, - Just $ rawPathInfo req, - Just $ rawQueryString req] - isHerokuSecure = lookup "x-forwarded-proto" hdrs == Just "https" - - if not (isSecure req || isHerokuSecure) - then case uriM of - Just uri -> - respond $ responseLBS status301 [ - (hLocation, cs . show $ uri { uriScheme = "https:" }) - ] "" - Nothing -> - respond $ responseLBS status400 [] "SSL is required" - else app req respond - unsupportedAccept :: Application -> Application unsupportedAccept app req respond = do let @@ -83,8 +57,9 @@ unsupportedAccept app req respond = do then respond $ responseLBS status415 [] "Unsupported Accept header, try: application/json" else app req respond -defaultMiddle :: Bool -> Application -> Application -defaultMiddle secure = (if secure then redirectInsecure else id) - . gzip def . cors corsPolicy +defaultMiddle :: Application -> Application +defaultMiddle = + gzip def + . cors corsPolicy . staticPolicy (only [("favicon.ico", "static/favicon.ico")]) . unsupportedAccept diff --git a/src/PostgREST/PgStructure.hs b/src/PostgREST/PgStructure.hs index b9db312ae..74d620078 100644 --- a/src/PostgREST/PgStructure.hs +++ b/src/PostgREST/PgStructure.hs @@ -45,7 +45,7 @@ doesProcReturnJWT = doesProc [H.stmt| ON pronamespace = n.oid WHERE nspname = ? AND proname = ? - AND pg_catalog.pg_get_function_result(p.oid) = 'jwt_claims' + AND pg_catalog.pg_get_function_result(p.oid) like '%jwt_claims' |] tableFromRow :: (Text, Text, Bool) -> Table diff --git a/test/SpecHelper.hs b/test/SpecHelper.hs index 6dd276057..45cbcbe96 100644 --- a/test/SpecHelper.hs +++ b/test/SpecHelper.hs @@ -41,7 +41,7 @@ isLeft (Left _ ) = True isLeft _ = False cfg :: AppConfig -cfg = AppConfig dbString 3000 "postgrest_anonymous" "test" False "safe" 10 +cfg = AppConfig dbString 3000 "postgrest_anonymous" "test" "safe" 10 testPoolOpts :: PoolSettings testPoolOpts = fromMaybe (error "bad settings") $ H.poolSettings 1 30 @@ -76,7 +76,7 @@ withApp perform = do $ runWithClaims cfg (app dbstructure cfg body) req either (resp . errResponse) resp result - where middle = defaultMiddle False + where middle = defaultMiddle resetDb :: IO ()