starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Restrict API key usage by source IP #5879

New Issue
Closed
opened 2025-12-29 19:33:46 +01:00 by adam · 11 comments
adam commented 2025-12-29 19:33:46 +01:00
Owner
Copy Link

Originally created by @PieterL75 on GitHub (Jan 5, 2022).

Originally assigned to: @jeremystretch, @PieterL75 on GitHub.

NetBox version

v3.1.4

Feature type

Change to existing functionality

Proposed functionality

Limit the access to the API with a certain API key by source IPs

Use case

We have API keys that belong to 'service accounts'. The source IP of these services consumers are known.
We should be able to limit the usage of these service account API keys to only the known sources.
This cannot be done by firewalls but needs to go to the application layer

If an API key gets compromised, it cannot be used outside of that scope of source IPs

Database changes

API Keys

  • add multivalue 'Source IP'

External dependencies

No response

Originally created by @PieterL75 on GitHub (Jan 5, 2022). Originally assigned to: @jeremystretch, @PieterL75 on GitHub. ### NetBox version v3.1.4 ### Feature type Change to existing functionality ### Proposed functionality Limit the access to the API with a certain API key by source IPs ### Use case We have API keys that belong to 'service accounts'. The source IP of these services consumers are known. We should be able to limit the usage of these service account API keys to only the known sources. This cannot be done by firewalls but needs to go to the application layer If an API key gets compromised, it cannot be used outside of that scope of source IPs ### Database changes API Keys - add multivalue 'Source IP' ### External dependencies _No response_
adam added the status: acceptedtype: feature labels 2025-12-29 19:33:46 +01:00
adam closed this issue 2025-12-29 19:33:46 +01:00
adam commented 2025-12-29 19:33:46 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Jan 5, 2022):

This should be feasible to implement in our custom TokenAuthentication class. We currently override only the authenticate_credentials() method, which has access only to the token itself, but the authenticate() method receives the entire request. We just need a way to reference the requesting IP address when evaluating the credentials.

We'll also need to do a bit of grunt work around mapping allowed IPs (e.g. networks and/or lists of individual IPs), but I certainly hope we can manage that. 🙂

@jeremystretch commented on GitHub (Jan 5, 2022): This should be feasible to implement in our custom TokenAuthentication class. We currently override only the `authenticate_credentials()` method, which has access only to the token itself, but the `authenticate()` method receives the entire request. We just need a way to reference the requesting IP address when evaluating the credentials. We'll also need to do a bit of grunt work around mapping allowed IPs (e.g. networks and/or lists of individual IPs), but I certainly hope we can manage that. :slightly_smiling_face:
adam commented 2025-12-29 19:33:46 +01:00
Author
Owner
Copy Link

@hagbarddenstore commented on GitHub (Jan 5, 2022):

This should be feasible to implement in our custom TokenAuthentication class. We currently override only the authenticate_credentials() method, which has access only to the token itself, but the authenticate() method receives the entire request. We just need a way to reference the requesting IP address when evaluating the credentials.

We'll also need to do a bit of grunt work around mapping allowed IPs (e.g. networks and/or lists of individual IPs), but I certainly hope we can manage that. 🙂

Be aware that Python might not receive the "true" source IP because of being behind a proxy. It would be helpful if the documentation mentioned that where this feature is documented. Perhaps adding external links on how to configure passing remote IP in nginx, apache, etc.

https://www.nginx.com/resources/wiki/start/topics/examples/forwarded/

@hagbarddenstore commented on GitHub (Jan 5, 2022): > This should be feasible to implement in our custom TokenAuthentication class. We currently override only the `authenticate_credentials()` method, which has access only to the token itself, but the `authenticate()` method receives the entire request. We just need a way to reference the requesting IP address when evaluating the credentials. > > We'll also need to do a bit of grunt work around mapping allowed IPs (e.g. networks and/or lists of individual IPs), but I certainly hope we can manage that. 🙂 Be aware that Python might not receive the "true" source IP because of being behind a proxy. It would be helpful if the documentation mentioned that where this feature is documented. Perhaps adding external links on how to configure passing remote IP in nginx, apache, etc. https://www.nginx.com/resources/wiki/start/topics/examples/forwarded/
adam commented 2025-12-29 19:33:47 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Mar 7, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our contributing guide.

@github-actions[bot] commented on GitHub (Mar 7, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. NetBox is governed by a small group of core maintainers which means not all opened issues may receive direct feedback. Please see our [contributing guide](https://github.com/netbox-community/netbox/blob/develop/CONTRIBUTING.md).
adam commented 2025-12-29 19:33:47 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Mar 10, 2022):

Can we keep this open ? Our compliance team is asking about when this could be implemented

@PieterL75 commented on GitHub (Mar 10, 2022): Can we keep this open ? Our compliance team is asking about when this could be implemented
adam commented 2025-12-29 19:33:47 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 10, 2022):

@PieterL75 would you like to volunteer to own it?

@jeremystretch commented on GitHub (Mar 10, 2022): @PieterL75 would you like to volunteer to own it?
adam commented 2025-12-29 19:33:47 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Mar 10, 2022):

I lack real coding ethics, but never afraid of a challenge...
I'll give it a try.

Must be in netbox/netbox/api/authentication.py ?

adding a check under TokenPermissions/has_permission() ?

@PieterL75 commented on GitHub (Mar 10, 2022): I lack real coding ethics, but never afraid of a challenge... I'll give it a try. Must be in netbox/netbox/api/authentication.py ? adding a check under TokenPermissions/has_permission() ?
adam commented 2025-12-29 19:33:47 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Mar 11, 2022):

Looks like I have a working solution...
@jeremystretch Can you review this branch in my fork : https://github.com/PieterL75/netbox/tree/master
Or should I create a PR here

@PieterL75 commented on GitHub (Mar 11, 2022): Looks like I have a working solution... @jeremystretch Can you review this branch in my fork : https://github.com/PieterL75/netbox/tree/master Or should I create a PR here
adam commented 2025-12-29 19:33:48 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 25, 2022):

Given the substantial changes being introduced here (namely adding the allowed_ips field to the Token model), I'd like to tag this for v3.2.

@PieterL75 would you mind rebasing your PR on the feature branch? I don't think you'll run into much trouble but please let me know if I can be of assistance.

@jeremystretch commented on GitHub (Mar 25, 2022): Given the substantial changes being introduced here (namely adding the `allowed_ips` field to the Token model), I'd like to tag this for v3.2. @PieterL75 would you mind rebasing your PR on the `feature` branch? I don't think you'll run into much trouble but please let me know if I can be of assistance.
adam commented 2025-12-29 19:33:48 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Apr 8, 2022):

I am assuming we would want to shoot for v3.3 now?

@DanSheps commented on GitHub (Apr 8, 2022): I am assuming we would want to shoot for v3.3 now?
adam commented 2025-12-29 19:33:48 +01:00
Author
Owner
Copy Link

@PieterL75 commented on GitHub (Apr 8, 2022):

What about 3.2.1 ?
I'm off for a week, going to do the rebase when I'm back

@PieterL75 commented on GitHub (Apr 8, 2022): What about 3.2.1 ? I'm off for a week, going to do the rebase when I'm back
adam commented 2025-12-29 19:33:49 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Apr 8, 2022):

It's an API change, so it'll need to go in the next minor release (v3.3).

@jeremystretch commented on GitHub (Apr 8, 2022): It's an API change, so it'll need to go in the next minor release (v3.3).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: feature
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#5879
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?