在线时间:8:00-16:00
迪恩网络APP
随时随地掌握行业动态
扫描二维码
关注迪恩网络微信公众号
开源软件名称:google/magic-github-proxy开源软件地址:https://github.com/google/magic-github-proxy开源编程语言:Python 99.4%开源软件介绍:Magic GitHub API ProxyThis is a stateless GitHub API proxy that allows creation and use of access-limited GitHub API tokens. Basically, it's identity and access management for GitHub API tokens. Why is this useful?GitHub's API tokens do not allow fine-grained control over which actions a token can perform (see this Dear GitHub issue). For example, you basically have to create a token that has full control over a repository to allow a token to just apply labels to issues. This is problematic at scale. When you have many jobs, processes, and/or bots interacting with the GitHub API you increase the likelihood that a token could be compromised and tokens with broad permissions have very high consequences. This proxy allows you to create API tokens with fine-grained permissions (a magic token) and then talk to the GitHub API using those magic tokens through a proxy. The proxy validates the magic token is allows to perform the requested action and then forwards the request to the GitHub API using the real GitHub API token. What does stateless mean?This proxy requires no backing storage and stores all of its state in the magic token itself. What? How?The proxy uses asymmetric cryptography (a public and private key pair) and JWTs to encode its state into the magic token. Each magic token is a simple JWT signed by the proxy's private key with these claims:
The The scopes claim determines what the magic token has access to. This proxy has a basic, rudimentary scope implementation described below, but you can implement any scoping strategy you want. The JWT is generated and signed by the proxy itself using its private key. This means the contents can not be tampered with without invalidating the JWT. ScopingBy default, this proxy has a simple scope strategy using the format:
Where For instance, to create a token that has access to any repository's issues in
UsageTODO DisclaimerThis is not an official Google product, experimental or otherwise. This is not a magic bullet for security. You assume all risks when using this project. |
2023-10-27
2022-08-15
2022-08-17
2022-09-23
2022-08-13
请发表评论