-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
fc0ce96
commit ae6f57a
Showing
12 changed files
with
180 additions
and
107 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,6 @@ | ||
# .env.example | ||
# API key for backend authentication | ||
VITE_API_KEY=your-api-key-here | ||
|
||
# The actual .env file would look similar but with real values | ||
# Remember to add .env to your .gitignore file |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,78 @@ | ||
# API Key Authentication for ServiceRadar Web Interface | ||
|
||
This document explains how the API key authentication works in the ServiceRadar web interface. | ||
|
||
## Overview | ||
|
||
The ServiceRadar web application has been updated to support API key authentication for all API requests to the backend. This follows the 12-factor application methodology by loading the API key from environment variables. | ||
|
||
## Setup Instructions | ||
|
||
### 1. Environment Configuration | ||
|
||
Create a `.env` file in the root directory of the project with the following content: | ||
|
||
``` | ||
VITE_API_KEY=your-api-key-here | ||
``` | ||
|
||
Make sure this matches the API key configured on your server. | ||
|
||
> **Note:** The `.env` file should never be committed to version control. A `.env.example` file is provided as a template. | ||
### 2. For Production Deployment | ||
|
||
In a production environment, you should set the environment variable according to your deployment platform: | ||
|
||
- **Docker:** Add it to your Docker Compose file or Docker run command: | ||
``` | ||
docker run -e VITE_API_KEY=your-api-key-here ... | ||
``` | ||
|
||
- **Kubernetes:** Add it to your deployment configuration: | ||
```yaml | ||
env: | ||
- name: VITE_API_KEY | ||
value: your-api-key-here | ||
# Or better, use a secret: | ||
env: | ||
- name: VITE_API_KEY | ||
valueFrom: | ||
secretKeyRef: | ||
name: serviceradar-secrets | ||
key: api-key | ||
``` | ||
- **Traditional hosting:** Set the environment variable in your hosting environment or through your CI/CD pipeline. | ||
### 3. Development Environment | ||
For local development, simply create a `.env` file as described above. The Vite development server will automatically load the environment variables. | ||
|
||
## How It Works | ||
|
||
1. The web interface reads the API key from the environment variable `VITE_API_KEY`. | ||
2. All API requests are processed through a centralized API service that automatically appends the API key as an `X-API-Key` header. | ||
3. The backend validates this header against its configured API key. | ||
4. Static assets (JavaScript, CSS, images) are exempt from API key validation. | ||
|
||
## API Service | ||
|
||
The API service is implemented in `src/services/api.js` and provides methods for making authenticated API requests: | ||
|
||
```javascript | ||
// Example usage: | ||
import { get, post } from '../services/api'; | ||
// GET request | ||
const data = await get('/api/nodes'); | ||
// POST request | ||
const response = await post('/api/some-endpoint', { key: 'value' }); | ||
``` | ||
|
||
## Security Considerations | ||
|
||
- The API key is included in the compiled JavaScript bundle and can be viewed by users with access to your application. This provides a basic level of authentication but should not be considered fully secure. | ||
- For more sensitive operations, consider implementing a more robust authentication system (OAuth, JWT, etc.). | ||
- Always use HTTPS in production to prevent the API key from being intercepted. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.