components-contrib Middleware loading failures allow unauthenticated/unauthorized traffic through

Expected Behavior

If you have bearer middleware or OPA middleware that is supposed to potentially control access to your APIs and an error occurs loading the middleware, the service shouldn't be accessible. If there is a failure to load those middleware types, the service should always block traffic beyond where those middleware layers were designed to protect.

EDIT: I put a little more thought into this and for OPA I think the default behavior if there is a failure to load would be a 403 and for the bearer middleware a 401. Because of that I am inclined to think the middleware component should handle that on its own instead of the code that loads it.

Actual Behavior

If you use middleware such as bearer and/or OPA and either of the middleware implementations can't loaded, it just allows all traffic to any services beyond the middleware. This essentially removes security from your APIs and is very undesirable. It seems like the correct behavior should be to block all traffic so security isn't leaked unintentionally.

Steps to Reproduce the Problem

Use OPA middleware to look for a specific header in a request.
Have invalid Rego such as below.
Add a bearer middleware as well
All traffic is allowed, regardless of the presence of a bearer token

` apiVersion: dapr.io/v1alpha1 kind: Component metadata: name: mypolicy spec: type: middleware.http.opa version: v1 metadata:
- name: includedHeaders value: "X-Origin" - name: defaultStatus value: 403 - name: rego value: | package http default allow = false allow = { "allow": true, "additional_headers" : other_headers } { jwt.payload["roles"][_] = "AccessProxy" input.request.headers["X-Origin"] }

apiVersion: dapr.io/v1alpha1 kind: Component metadata: name: bearertoken spec: type: middleware.http.bearer version: v1 metadata:

name: clientId value: ""
name: issuerURL value: "https://login.microsoftonline.com//v2.0" `

Release Note

RELEASE NOTE:

Apr 04 '22 18:04 ben-kotvis

Have you configured the HTTP middleware pipeline? Such as:

apiVersion: dapr.io/v1alpha1
kind: Configuration
metadata:
  name: pipeline
  namespace: default
spec:
  httpPipeline:
    handlers:
    - name: bearertoken
      type: middleware.http.bearer
    - name: mypolicy
      type: middleware.http.opa

You can get more info from https://docs.dapr.io/developing-applications/middleware/

Apr 09 '22 09:04 Taction

@Taction yes, that is exactly how my middleware config is setup (other than the metadata name and namespace).

Apr 09 '22 14:04 ben-kotvis