Commit Graph

94 Commits

Author SHA1 Message Date
Marcus Efraimsson 1c1427520d Security: Add new setting allow_embedding (#16853)
When allow_embedding is false (default) the Grafana backend 
will set the http header `X-Frame-Options: deny` in all responses 
to non-static content which will instruct browser to not allow 
Grafana to be embedded in `<frame>`, `<iframe>`, 
`<embed>` or `<object>`.

Closes #14189
2019-05-06 09:56:23 +02:00
Marcus Efraimsson f778c1d971 Security: Responses from backend should not be cached (#16848)
Currently all API requests set Cache-control: no-cache to avoid browsers 
caching sensitive data. This fixes so that all responses returned from 
backend not are cached using http headers. The exception is the data proxy 
where we don't add these http headers in case datasource backend needs 
to control whether data can be cached or not.

Fixes #16845
2019-05-06 09:22:59 +02:00
Carl Bergquist 9660356638 Auth: Enable retries and transaction for some db calls for auth tokens (#16785)
the WithSession wrapper handles retries and connection
management so the caller dont have to worry about it.
2019-04-30 14:42:01 +02:00
Oleg Gaidarenko 67cbc7d4cf Chore: use remote cache instead of session storage (#16114)
Replaces session storage in auth_proxy middleware with remote cache

Fixes #15161
2019-04-08 14:31:46 +03:00
Marcus Efraimsson 8678620730 move UserToken and UserTokenService to models package 2019-02-06 16:55:12 +01:00
Marcus Efraimsson a60124a88c change UserToken from interface to struct 2019-02-06 16:30:50 +01:00
Marcus Efraimsson 44275d9660 middleware fix 2019-02-06 08:45:01 +01:00
Marcus Efraimsson 871c84d195 changes needed for api/middleware due to configuration settings 2019-02-05 21:14:23 +01:00
Marcus Efraimsson d53e64a32c move auth token middleware/hooks to middleware package
fix/adds auth token middleware tests
2019-02-05 00:21:05 +01:00
bergquist f257101c41 removes unused/commented code 2019-01-24 11:26:45 +01:00
bergquist 5998646da5 restrict session usage to auth_proxy 2019-01-23 14:56:48 +01:00
Marcus Efraimsson 4096449aec extract auth token interface and remove auth token from context 2019-01-22 12:00:33 +01:00
bergquist 55b3013eb3 moves initWithToken to auth package 2019-01-21 11:37:44 +01:00
Marcus Efraimsson 734a7d38b2 set cookie name from configuration 2019-01-21 11:21:43 +01:00
Marcus Efraimsson 0d1e3759eb mixor fixes 2019-01-21 10:20:23 +01:00
Marcus Efraimsson f3125b447b dead code 2019-01-21 10:20:23 +01:00
bergquist 47a7d93fd9 moves rotation into auth since both happens before c.Next() 2019-01-21 08:59:01 +01:00
bergquist fd937e3d95 remove maxage from session token 2019-01-17 21:03:27 +01:00
Marcus Efraimsson 97c7963f17 fix cannot set cookie when response is written 2019-01-17 20:27:53 +01:00
bergquist c2accfa4c0 inital code for rotate 2019-01-17 17:11:52 +01:00
bergquist aba6148c43 login users based on token cookie 2019-01-16 16:44:40 +01:00
Marcus Efraimsson cfb061ddab refactor datasource caching 2018-10-30 09:31:56 +01:00
Mario Trangoni e673337cb9 pkg/middleware/middleware.go: Fix empty branch warning.
See,
$ gometalinter --vendor --deadline 10m --disable-all --enable=megacheck ./...
pkg/middleware/middleware.go:46:3⚠️ empty branch (SA9003) (megacheck)
2018-10-19 19:49:04 +02:00
Torkel Ödegaard abef94b0da made it possible to have frontend code in symlinked folders that can add routes 2018-10-11 12:36:04 +02:00
Torkel Ödegaard 80d694d205 Backend image rendering as plugin (#11966)
* rendering: headless chrome progress

* renderer: minor change

* grpc: version hell

* updated grpc libs

* wip: minor progess

* rendering: new image rendering plugin is starting to work

* feat: now phantomjs works as well and updated alerting to use new rendering service

* refactor: renamed renderer package and service to rendering to make renderer name less confusing (rendering is internal service that handles the renderer plugin now)

* rendering: now render key is passed and render auth is working in plugin mode

* removed unneeded lines from gitignore

* rendering: now plugin mode supports waiting for all panels to complete rendering

* fix: LastSeenAt fix for render calls, was not set which causes a lot of updates to Last Seen at during rendering, this should fix sqlite db locked issues in seen in previous releases

* change: changed render tz url parameter to use proper timezone name as chrome does not handle UTC offset TZ values

* fix: another update to tz param generation

* renderer: added http mode to renderer service, new ini setting [rendering] server_url
2018-05-24 15:26:27 +02:00
Dan Cech 1c5afa731f shared library for managing external user accounts 2018-04-17 14:06:25 -04:00
Dan Cech c0ecdee375 rename Context to ReqContext 2018-03-07 11:54:50 -05:00
Dan Cech 338655dd37 move Context and session out of middleware 2018-03-06 18:16:49 -05:00
Torkel Ödegaard 0e61a670bb fix: error handling now displays page correctly, fixes #10777 2018-02-06 12:28:17 +01:00
Torkel Ödegaard a8a5f8181b fix: viewers can edit now works correctly 2017-12-15 14:19:49 +01:00
bergquist 2de94d6548 convert old metrics to prom metrics 2017-09-14 14:26:32 +02:00
Torkel Ödegaard 668cb3c1ef Merge branch 'v4.4.x' 2017-08-09 10:37:06 +02:00
Torkel Ödegaard e8a20643d6 feat: store last seen date for users and present in stats and user lists, closes #9007 2017-08-09 10:36:41 +02:00
Daniel Lee e6f9546a7c api: add no cache headers for IE11
Adds pragma and expires headers for API calls so that IE11 does not
cache GET calls. Ref #5356
2017-07-06 18:56:22 +02:00
Daniel Lee 74093c700f api: adds no-cache header for GET requests
Fixes #5356. Internet Explorer aggressively caches GET requests which
means that all API calls fetching data are cached. This fix adds a
Cache-Control header with the value no-cache to all GET requests to
the API.
2017-07-04 21:26:05 +02:00
Dan Cech f490c5f12c use X-Grafana-Org-Id header to ensure backend uses correct org (#8122) 2017-04-14 15:47:39 +02:00
Utkarsh Bhatnagar 5777f65d05 Basic Auth now supports LDAP username and password (#6940) 2016-12-13 09:15:52 +01:00
Torkel Ödegaard 05772b30d7 feat(ux): completed work on getting started panel, #6466 2016-12-08 10:25:05 +01:00
Torkel Ödegaard 18e965c775 fix(error handling): fixed server side error handling page 2016-11-16 17:41:44 +01:00
Torkel Ödegaard 175c651e65 fix(server side rendering): Fixed issues with server side rendering for alerting & for auth proxy scenarios, fixes #6115, fixes #5906 2016-09-23 12:29:53 +02:00
bergquist e7b56c6389 tech(metrics): move all request counters into one middleware 2016-09-09 13:28:19 +02:00
Torkel Ödegaard bf1ea560e9 feat(logging): error logging improvements 2016-06-11 12:16:33 +02:00
Torkel Ödegaard 65aad44464 feat(logging): added uname to context logger 2016-06-07 12:20:46 +02:00
Torkel Ödegaard 9741af2031 feat(logging): progress on new logging #4590 2016-06-07 09:29:47 +02:00
Torkel Ödegaard 22778e6efd feat(logging): a lot of progress on moving to new logging lib, #4590 2016-06-06 23:06:44 +02:00
Torkel Ödegaard 3065d10931 feat(timing): timing is now working with graphite and influxdb 2016-06-03 09:17:36 +02:00
Torkel Ödegaard 6da3af5e89 Merge branch 'new_macaron' 2016-01-13 15:48:49 +01:00
bergquist 4fe72ebf69 feat(macaron): upgrades macaron version 2016-01-13 15:11:23 +01:00
Torkel Ödegaard ad94f99d57 refactor(apps): more WIP work on apps 2015-12-22 11:37:44 +01:00
Torkel Ödegaard eacc46da6d feat(plugins): WIP on new apps concept 2015-12-21 23:09:27 +01:00