user JWT Src limits can be used for in-process connection about nats-server HOT 7 CLOSED

This should be addressed with PR #5395. Closing this issue now.

from nats-server.

or maybe we can add another connection type: Pipe
and we can limit connection type of user to it

from nats-server.

@chezgi Adding a new connection type may not be enough because the server would still do network source validation and fail (unless we change that code anyway).

Since one can technically run a server from a process but that server be configured to have listen ports opened and still make InProcess connections (see

• disable source validation if we detect that the client is in-process
• do source validation but add support for "inprocess" (or "pipe") in the JWT library's CIDR list

One could argue that the JWT configuration/limits should be respected and therefore, adding the "inprocess" CIDR would make more sense? @derekcollison what do you think?

@chezgi By the way, how are you running the server? Are you setting the DontListen option or somehow connect in-process clients without the DontListen option?

from nats-server.

@chezgi Or are you saying that you would then add a "PIPE" connection type to that JWT but then remove the CIDR? In other words, you want to use a JWT but want to make sure that only an in-process client can use that JWT?

If you were to configure the server with the DontListen option, you would necessarily limit clients that are in-process (since they would not have any way to connect to this server) and that proposal would be moot. Any reason why you are not running this way?

from nats-server.

@kozlovic
my usage: i want to use my authorization callout user to be in process.
therefore my jwt must limit this user for only in process connection,
or 127.0.0.1 must interpreted to in process connection type .

server is servicing others from network, therefore DontListen is disabled.
and this user can't have source connection limit. and it is very insecure in this situation.

from nats-server.

@chezgi But then this PR (#5395) won't be enough, right? I mean as long as you define a Src limit, in-process connections won't work (even with the PR). If you have to use CIDR, then should you have 2 different JWT: one with CDIR and allow connection type STANDARD) and one with no CDIR and allow connection type IN_PROCESS?

from nats-server.

@kozlovic
if i can limit user jwt to only IN_PROCESS connection type, it works for me.

from nats-server.