{"action":"created","issue":{"url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/117","repository_url":"https://api.github.com/repos/wildfly/wildfly-proposals","labels_url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/117/labels{/name}","comments_url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/117/comments","events_url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/117/events","html_url":"https://github.com/wildfly/wildfly-proposals/pull/117","id":348718557,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA3MDAxOTkx","number":117,"title":"[WFCORE-3999] Allow registering a custom HTTP handler for management interface","user":{"login":"jmesnil","id":6193,"node_id":"MDQ6VXNlcjYxOTM=","avatar_url":"https://avatars2.githubusercontent.com/u/6193?v=4","gravatar_id":"","url":"https://api.github.com/users/jmesnil","html_url":"https://github.com/jmesnil","followers_url":"https://api.github.com/users/jmesnil/followers","following_url":"https://api.github.com/users/jmesnil/following{/other_user}","gists_url":"https://api.github.com/users/jmesnil/gists{/gist_id}","starred_url":"https://api.github.com/users/jmesnil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmesnil/subscriptions","organizations_url":"https://api.github.com/users/jmesnil/orgs","repos_url":"https://api.github.com/users/jmesnil/repos","events_url":"https://api.github.com/users/jmesnil/events{/privacy}","received_events_url":"https://api.github.com/users/jmesnil/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-08-08T13:09:08Z","updated_at":"2018-08-08T17:55:42Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/wildfly/wildfly-proposals/pulls/117","html_url":"https://github.com/wildfly/wildfly-proposals/pull/117","diff_url":"https://github.com/wildfly/wildfly-proposals/pull/117.diff","patch_url":"https://github.com/wildfly/wildfly-proposals/pull/117.patch"},"body":"Issue: https://issues.jboss.org/browse/WFCORE-3999"},"comment":{"url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/comments/411495840","html_url":"https://github.com/wildfly/wildfly-proposals/pull/117#issuecomment-411495840","issue_url":"https://api.github.com/repos/wildfly/wildfly-proposals/issues/117","id":411495840,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTQ5NTg0MA==","user":{"login":"bstansberry","id":299242,"node_id":"MDQ6VXNlcjI5OTI0Mg==","avatar_url":"https://avatars1.githubusercontent.com/u/299242?v=4","gravatar_id":"","url":"https://api.github.com/users/bstansberry","html_url":"https://github.com/bstansberry","followers_url":"https://api.github.com/users/bstansberry/followers","following_url":"https://api.github.com/users/bstansberry/following{/other_user}","gists_url":"https://api.github.com/users/bstansberry/gists{/gist_id}","starred_url":"https://api.github.com/users/bstansberry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bstansberry/subscriptions","organizations_url":"https://api.github.com/users/bstansberry/orgs","repos_url":"https://api.github.com/users/bstansberry/repos","events_url":"https://api.github.com/users/bstansberry/events{/privacy}","received_events_url":"https://api.github.com/users/bstansberry/received_events","type":"User","site_admin":false},"created_at":"2018-08-08T17:55:42Z","updated_at":"2018-08-08T17:55:42Z","author_association":"CONTRIBUTOR","body":"This needs some clarification re: security integration.  I don't think we want the caller of this new method to take responsibility for standard security integration, but OTOH we need an option to tell the kernel to require authentication for a context, and also need to be able to have a context not require authentication.\r\n\r\nMP Health spec says this:\r\n\r\n```\r\nSecurity\r\nIt must be possible to secure the endpoints via the usual means. The definition of 'usual means' is in this version of the specification implementation specific.\r\n\r\nIn case of a secured endpoint, accessing /metrics without valid credentials must return a 401 Unauthorized header.\r\n\r\nA server SHOULD implement TLS encryption by default.\r\n\r\nIt is allowed to ignore security for trusted origins (e.g. localhost)\r\n```\r\n\r\nSo, we have to be able to turn security on/off on the /health context.\r\n\r\nMP Metrics says this:\r\n\r\n```\r\nSecurity\r\nIt must be possible to secure the endpoints via the usual means. The definition of 'usual means' is in this version of the specification implementation specific.\r\n\r\nIn case of a secured endpoint, accessing /metrics without valid credentials must return a 401 Unauthorized header.\r\n\r\nA server SHOULD implement TLS encryption by default.\r\n\r\nIt is allowed to ignore security for trusted origins (e.g. localhost)\r\n```\r\n\r\nTo me in our case the 'usual means' means you get the normal security configured on the management interface.  And the spec says nothing about default behavior, beyond TLS, but IMO the default should be to require authentication. Metrics can expose all sorts of information."}}
{"actor":{"display_login":"bstansberry"}}