Cloud Platform as a Service

Harden the setup

You have completed a setup which you can use to restrict access to your app endpoint using IP address filters. This is a useful addition to traditional authentication and authorization that you will likely still require for use cases where you want to allow callers to perform different actions depending on their role.

Having mapped your domain to Cloud Internet Services and Proxy mode enabled, you have actually hidden that the backend of this domain is hosted on Code Engine. Still, users with insider knowledge who somehow know that your backend is running in Code Engine, can figure out how to by-pass your Cloud Internet Services instance and its firewall rules.

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

/**
 * Set a custom header
 * @param {Request} request
 */
async function handleRequest(request) {
  // Best practice is to always use the original request to construct the new request
  const newRequest = new Request(request);

  // Inject a secret that is only known to the Code Engine app
  newRequest.headers.set("x-cis-secret", "Some-Secret");
  return fetch(newRequest);
}

In the IBM Cloud Console,

1. In Code Engine

   • Navigate to the "Secrets and configmaps" on the project overview page

   • Create a generic secret named "cis-secret" and add a key-value pair "CIS_SECRET=Some-Secret"

   • Navigate to the details page of app "myapp"

   • Click on "Configuration" and switch to tab "Environment variables"

   • Click "Add environment variable"

   • In the "Add environment variable" panel select "Reference to full secret" and select the "cis-secret" and click "Add"

   • Update the apps configuration by clicking "Deploy"

2. In the CIS instance

• • Navigate to "Edge Function"

  • Click on tab "Actions",

  • Click "Create",

  • Replace the sample source code with the content of locally stored file "ce-cis--edge-function.js" and click "Save"

  • Click on tab "Triggers" and click "Create"

  • Provide your domain URL as "Trigger URL”, e.g. "myapp.example.com”

  • Select the action that has been created in the previous step and confirm by clickling "Save"

  • Click "Create" to create a second trigger

  • Provide the domain including a slash and a wildcard character has "Trigger URL", e.g. "myapp.example.com/*"

  • Select the action that has been created in the previous step and confirm by clickling "Save"

Using the IBM Cloud CLI, the same rule can be created as follows

# Adjust the app by introducing a secret 
# make sure to replace "Some-Secret" accordingly with the value that you stored in "ce-cis--edge-function.js"
ibmcloud ce secret create --name cis-secret --from-literal CIS_SECRET="Some-Secret"
ibmcloud ce app update --name myapp --env-from-secret cis-secret

# Create the CIS Edge Function along with the two triggers
ibmcloud cis edge-functions-action-create --name add-a-secret-header --javascript-file ./ce-cis--edge-function.js
ibmcloud cis edge-functions-trigger-create $DNS_DOMAIN_ID "$DOMAIN_NAME" --name add-a-secret-header
ibmcloud cis edge-functions-trigger-create $DNS_DOMAIN_ID "$DOMAIN_NAME/*" --name add-a-secret-header

Alright, everything is in place. Let us check whether it works as expected. As you can see below, the header value, which has been injected by the CIS Edge Function, and the environment variable value are both exposed to the app instance. 

curl --silent -4 https://myapp.example.com/debug |jq

{
  "headers": {
    "x-cis-secret": "Some-Secret",
    …
  },
  "url": "/debug",
  "method": "GET",
  "env": {
    ...
    "CIS_SECRET": "Some-Secret",
  }
}

Last thing to do is to adjust the apps source code by adding a check that makes sure the injected header value equals the environment variable value. In case these values are not the same, the caller has not been routed through the CIS instance and hence the request should get rejected by the app. In case you'll want to apply the same mechanism to a Code Engine Function, the following documentation page provides details on how to access headers. For a Node.js app, the following code snippet can be used to harden your solution:

// If the app has been configured to check the CIS secret, 
// make sure that the request header value 'x-cis-secret' matches the configured secret.
// If it doesn't match, assume that the request bypassed the CIS firewall and reject it.
if(process.env.CIS_SECRET && request.headers['x-cis-secret'] !== process.env.CIS_SECRET){
  response.writeHead(403);
  return response.end();
}

And that is it 🎉

Conclusion

We have configured an IBM Cloud Internet Services instance in a way that allows to pass the clients IP address to an IBM Cloud Code Engine app. Furthermore, we demonstrated how allow list and block single IP addresses as well as entire IP ranges on an entire domain, using Cloud Internet Services security features.

What's next?

• You can further explore features that Cloud Internet Services provide, such as the Web Application Firewall or Rate limiting

• You can explore Metrics features to observe firewall events

If you have feedback, suggestions, or questions about this post, please reach out to us; e.g. on LinkedIn Enrico Regge or via E-Mail.