Score:0

Gitlab Access Tokens, protected by authenticating Apache Reverse Proxy?

cn flag

We hide a Gitlab instance (among several other applications) behind a single Apache Reverse Proxy, that is doing user authentication (OpenID) before granting further access to the lower services.

This allows us to have only one Service (Apache) exposed to the public, one service being potentially attacked.

Since Gitlab provides access tokens (technically: basic auth) for granting access to its git repositories, we are forced to allow git URLs to pass our proxy without any authentication to have them authenticated by Gitlab itself.

This technically opens a second attack vector, since unauthenticated users can reach Gitlab directly.

Is there a feasible setup that does not open this second vector? Something like

  1. User sends request with token header
  2. Apache tries to authenticate against Gitlab using this token
  3. Only on successful authentication, Apache lets the request pass to Gitlab
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.