Systems and method for hypertext transfer protocol requestor validation
HTTP requests and responses may be transmitted between cloud-based application instances. Each outgoing HTTP request may include authentication credentials and an “X-Snc-Integration-Source” header that identifies the source of the request. A table of approved users may be maintained, including each user's authentication credentials and one or more source instances from which they are expected to generate HTTP requests. When the HTTP request is received, the HTTP request will be parsed to identify the authentication credentials and the source of the request. The table of authorized users is then referenced to determine if the authentication credentials and the source of the request match those of an authorized user. If the authentication credentials and the source of the request match those of an authorized user, access will be granted. If the authentication credentials and the source of the request do not match those of an authorized user, access will be denied.
1. A system, comprising:
a hosted instance hosted by a datacenter, wherein the hosted instance is configured to communicate with one or more client instances generated for one or more client networks, the hosted instance configured to perform operations comprising:
receiving a hypertext transfer protocol (HTTP) request sent to the hosted instance from a client instance of the one or more client instances;
determining that augmented basic access authentication is enabled;
in response to determining that augmented basic access authentication is enabled, determining that the HTTP request contains a first header, wherein the first header comprises a first character string identifying the first header as a source header and a second character string identifying the client instance as a source of the HTTP request, and wherein the first character string identifies an authentication protocol by which credentials are authorized;
determining, based on the first header, that the client instance is included in a registry;
in response to determining that the client instance is included in the registry, determining that the HTTP request contains a second header comprising a username and password associated with a user of the client instance; and
authorizing access to the hosted instance for the client instance.
2. The system of claim 1 , wherein the operations comprise:
retrieving one or more pieces of information requested in the HTTP request;
generating an HTTP response; and
transmitting the HTTP response and the information requested in the HTTP request to the client instance.
3. The system of claim 1 , wherein the operations comprise determining that the system is enforcing augmented basic access authentication.
4. The system of claim 1 , wherein the operations comprise:
determining that the system is not enforcing augmented basic access authentication; and
authorizing access to the hosted instance for the client instance in response to determining, based on the first header, that the client instance is included in the registry.
5. The system of claim 4 , wherein the operations comprise updating an authorized users list to associate the username, the password, and the source with the user of the client instance, in response to determining that the username, the password, or the client instance, or a combination thereof, do not match the credentials associated with the user of the client instance on the authorized users list stored in the registry.
6. The system of claim 1 , wherein the operations comprise:
determining that the username, the password, or the client instance, or a combination thereof, do not match the credentials associated with an approved user on an authorized users list stored in the registry; and
generating and logging an authorization failure ticket in response to determining that the username, the password, or the client instance, or a combination thereof, do not match the credentials associated with an approved user on an authorized users list stored in the registry.
7. The system of claim 1 , wherein the second character string identifying the client instance as the source of the HTTP request is extracted from a file upon a startup of the client instance.
8. A system, comprising:
a hosted instance hosted by a datacenter, wherein the hosted instance is configured to communicate with one or more client instances generated for one or more client networks, the hosted instance configured to perform operations comprising:
receiving a hypertext transfer protocol (HTTP) request sent to the hosted instance from a client instance of the one or more client instances;
determining that augmented basic access authentication is enabled;
in response to determining that augmented basic access authentication is enabled, determining that the HTTP request contains a first header, wherein the first header comprises a first character string identifying the first header as source header and a second character string identifying the client instance as a source of the HTTP request, and wherein the first character string identifies an authentication protocol by which credentials are authorized;
determining, based on the first header, that the client instance is included in a registry; and
allowing or denying access to the hosted instance for the client instance based on whether the client instance matches credentials associated with an approved user on an authorized users list stored in the registry.
9. The system of claim 8 , wherein the operations comprise:
determining that the system is not enforcing augmented basic access authentication; and
allowing access to the hosted instance for the client instance in response to determining that a username, a password, and the client instance match the credentials associated with the approved user on the authorized users list stored in the registry.
10. The system of claim 9 , wherein the operations comprise:
determining, in response to determining that the augmented basic access authentication is enabled and is not being enforced, that the system is in a learning mode; and
in response to determining that the system is in the learning mode, adding entries to the authorized user list stored in the registry.
11. The system of claim 9 , wherein the operations comprise updating the authorized users list to associate the username, the password, and the source with the approved user in response to determining that the username, the password, or the client instance, or a combination thereof, do not match the credentials associated with the approved user on the authorized users list stored in the registry.
12. The system of claim 9 , wherein the operations comprise:
retrieving one or more pieces of information requested in the HTTP request;
generating an HTTP response; and
transmitting the HTTP response and the information requested in the HTTP request to the client instance.
13. The system of claim 8 , wherein the operations comprise:
determining that the system is enforcing augmented basic access authentication; and
denying access to the hosted instance for the client instance in response to determining that a username, a password, or the client instance, or a combination thereof, do not match the credentials associated with the approved user on the authorized users list stored in the registry.
14. The system of claim 8 , wherein the operations comprise generating and logging an authorization failure ticket in response to determining that a username, a password, or the client instance, or a combination thereof, do not match the credentials associated with the approved user on the authorized users list stored in the registry.
15. A method, comprising:
receiving a hypertext transfer protocol (HTTP) request sent to a hosted instance from a client instance;
determining that augmented basic access authentication is enabled;
in response to determining that augmented basic access authentication is enabled, determining that the HTTP request contains a first header, wherein the first header comprises a first character string identifying the first header as a source header and a second character string identifying the client instance as a source of the HTTP request, and wherein the first character string identifies an authentication protocol by which credentials are authorized; and
in response to determining that the HTTP request contains a particular source header and that a username and password associated with a user of the client instance match credentials stored in a registry, authorizing or denying access to the hosted instance for the client instance based on whether the source, username, and password match credentials associated with an approved user on an authorized users list.
16. The method of claim 15 , comprising:
retrieving one or more pieces of information requested in the HTTP request;
generating an HTTP response; and
transmitting the HTTP response and the information requested in the HTTP request to the client instance.
17. The method of claim 15 , comprising:
determining that the client instance identified as the source does not match credentials stored in the registry;
determining that augmented basic access authentication is not being enforced; and
authorizing access to the hosted instance for the client instance.
18. The method of claim 17 , comprising updating the registry to associate the source with a particular approved user.
19. The method of claim 15 , comprising:
determining that the client instance identified as the source does not match credentials stored in the registry;
determining that augmented basic access authentication is being enforced; and
denying access to the hosted instance for the client instance.