Ghostwriter: GraphQL: Unable to interface with endpoint
I’m following the documentation (https://www.ghostwriter.wiki/features/graphql-api) and trying to interface with the GraphQL endpoint
Using the example request:
import json
import requests
headers = {"Content-Type": "application/json", }
def prepare_query(query, operation):
return json.dumps({
"query": query,
"operationName": operation
})
def post_query(headers, data):
return requests.post(
"https://127.0.0.1/v1/graphql",
headers=headers,
data=data
)
# Stacked query with `Login` and `Whoami` operations
query = """
mutation Login {
login(password:"<redacted>", username:"<redacted>") {
token expires
}
}
query Whoami {
whoami {
username role expires
}
}
"""
# Send query and set `Login` as the `operationName`
response = post_query(headers, prepare_query(query, "Login"))
# Get the JWT from the response and add it to the headers
token = response.json()["data"]["login"]["token"]
headers["Authorization"] = f"Bearer {token}"
# Send the query again but execute the `Whoami` operation this time
response = post_query(headers, prepare_query(query, "Whoami"))
# Print our JWT's whoami informaiton
print(response.json())
When using the example request, I receive the following response as part of a 200:
{'errors': [{'extensions': {'path': '$', 'code': 'unexpected'}, 'message': 'Invalid response from authorization hook'}]}
I created an API key and used that directly as the Bearer token, but receive the same Invalid response from authorization hook error as above.
I enabled Hasura, and similarly receive an error when attempting to perform the login query (Hasura POST’s to https://127.0.0.1/v1/graphql):
However, I can perform ‘other’ types of queries (when authenticated with the x-hasura-admin-secret) without an issue:
Can someone please assist with the issue and let me know how I can interface with the API via python without relying on Hasura?
Does the documentation need to be updated
About this issue
- Original URL
- State: open
- Created 2 years ago
- Comments: 23
@zachfey Thanks for confirming that helped! I appreciate the offer, but I think I’ve got everything I need right now. If new certificates help the others that will confirm the certificates are the root cause. I’ll leave this open for a while to collect feedback.
@chrismaddalena I have this same issue, however I was unable to solve this with adding a CA. As a workaround I used x-hasura-admin-secret. GraphQL queries work. However mutation queries don’t.
Performing the generateReport mutation results in a
http exception when calling webhook. With error messageProxy connection to nginx:443 returned response with status code that indicated failure: 502The error above is the same error which I receive when using the mutation Login query. I don’t understand why queries work, but mutations don’t.
Additional info: I enabled debug in the nginx.conf as mentioned in https://github.com/GhostManager/Ghostwriter/issues/238#issuecomment-1225016285. This didn’t result in any info logging in the error logging sadly.
Last edit and solution: This might be important information for anyone working from within an enterprise environment. Our Docker environment needs to pass through a webproxy. So we edited our docker config.json to include this:
However the config above causes all the internal containers to go over the proxy. Causing nginx webhook calls to fail. In order to fix this the noProxy must be set. I’ve added the following line to the config.json:
"noProxy": "django,postgres,redis,nginx,queue,graphql_engine"@chrismaddalena I think this can also be fixed by expanding the
no_proxyvariables set in the https://github.com/GhostManager/Ghostwriter/blob/master/production.ymlAfter fixing the proxy issue I used these instructions to generate a certificate with the CN nginx https://github.com/GhostManager/Ghostwriter/issues/238#issuecomment-1252889629
I was having the same issue and generating a new self-signed certificate worked! Thanks @chrismaddalena
I also tried a new certificate with the CN set to
nginx. That also worked without issue. The issue returned when I restored the original certificate files. The default certificate seems to be the problem.To avoid issues with
opensslnot being in the PATH, Ghostwriter CLI generates the certificate entirely through Golang. Perhaps this causes a variance in the output base don the OS or OS version. I didn’t encounter this issue with the certificate on macOS or Debian 11, but see it on Amazon Linux.Please let me know if a new certificate helps you.
Hey @SecurityJon, thanks for letting me know! I was traveling last week for Black Hat USA, so I couldn’t look into this much. I am diving back into this now and am dedicated to finding an answer. I’m trying to work with the Hasura developers to see if I can learn more about the exception.
There is a workaround if you need to interact with the API right now. You can bypass the authentication by using the
x-hasura-admin-secretheader. You will authenticate as an administrator and Hasura won’t use the webhook to authenticate your requests. If you do this, please be very careful. An administrator can do anything. You could delete or change things that should not be deleted or changed or override values that should be set automatically or auto-increment (e.g.,idfields).One other thing to look at:
https://www.ghostwriter.wiki/getting-started/quickstart#customizing-the-domain-name-or-ip-address
Hasura needs to talk to
https://{NGINX_HOST}:{NGINX_PORT}. The default value for{NGINX_HOST}isnginx. That works as long asnginxappears in the list of allowed hostnames.I did have a situation where
nginxdid not work because of the TLS certificate. In that case, settingNGINX_HOSTto the domain name used for DNS and the certificate resolved the issue–i.e., there is DNS and a cert forghostwriter.foo.bar, soNGINX_HOSTchanges toghostwriter.foo.bar.It’s been a while, but in that situation, there were no logs because a connection was never properly established. That made it difficult to troubleshoot. If you aren’t seeing anything in the logs, that may be the solution for you.