Client cert on Request

[nyarly]

I'm looking at building a pure-API service with webmachine. I'd like to be able to do SSL and authenticate with client certs, but I realize that accessing the cert itself means digging into the LazyRequestBody with instance_var_get.

I'd like to add a field on Webmachine::Request, but it'd mean adding a little code to each adapter, as far as I can tell.

[Asmod4n]

I know my stance is rather restrictive when it comes to cryptography, but it shouldn't be run in the same process as the "business logic".

Have you taken a look at nginx http_ssl_module? It can do certificate verification and add the required information to http headers. http://nginx.org/en/docs/http/ngx_http_ssl_module.html#variables

[seancribbs]

Actually, it should be perfectly reasonable to do certificate authentication. The problem usually is that every single webserver exposes (or not) this information differently! If we can get to the actual socket, usually you can make OpenSSL calls on it to read the peer cert, but again, it's extremely inconsistent.

[nyarly]

Apache has similar headers that it'll set. It would certainly be nice if Webmachine could handle those correctly (although there's some trickiness around ensuring that fake headers aren't set by the client...)

And yes: every SSL connection terminator has it's own slightly different way of formatting the certificates - from the various Ruby servers that will handle it, to front end servers that'll attach verification headers.

Would the best solution to be to recommend a Rack middleware - possibly a middleware per terminator - to adapt the certificate into a predicatable place and format?

It'd be nice, ultimately, to have Webmachine::Request#client_cert iff the request was verified and not have to worry about it. Realistically, client software is going to have to provide some configuration related to how the SSL is terminated, but getting the verified cert in one place and one format seems like a big win.

[seancribbs]

I'm not saying don't do it, I'm just saying I've tried before and failed miserably. Please do investigate.

[nyarly]

Okay, cool. 👍