ballerina編譯器已經集成了部分安全檢測，在編譯時可以幫助我們生成錯誤提示，同時ballerina 標準庫
已經對於常見漏洞高發的地方做了很好的處理，當我們編寫了有安全隱患的程式碼，編譯器就已經提示給
我們了。
常見的問題

• sql 注入
• path 操作
• file 操作
• 未授權檔案訪問
• 為校驗的重定向

確保ballerina 標準庫的安全

ballerina 標準庫對於安全敏感的函式以及操作使用@sensitive 註解進行說明，可以確保容易出現漏洞的資料傳遞
給引數
比如,ballerina 標準庫的select

public native function select(@sensitive string sqlQuery, typedesc? recordType,
                              boolean loadToMemory = false, Param... parameters)
                             returns @tainted table|error;
 

安全的使用不可信資料

實際中我們肯定會碰到需要傳遞非可信資料，我們可以使用 untaint 表示式進行處理，同時對於返回值我們可以使用
@untainted 註解
參考

boolean isValid = isNumeric(studentId);
if (isValid) {
   var dt = testDB->select("SELECT NAME FROM STUDENT WHERE ID = " +
                           untaint studentId, ResultStudent);
}

function sanitizeSortColumn (string columnName) returns @untainted string {
   string sanitizedSortColumn = columnName;
   // Sanitize logic to make sure return value is safe
   return sanitizedSortColumn;
}
 

保護密碼以及secret key

ballerina 提供了api 可以訪問不同源的配置資訊，對於配置檔案中包含密碼資訊的必須加密
處理，框架提供了工具可以對於配置進行加密

ballerina encrypt
按照提示輸入需要加密的名稱，會生成一個加密key，我們可以使用配置檔案，或者環境變數獲取。
預設會找一個secret.txt的檔案，裡面儲存了加密金鑰，請求之後會自動刪除，對於沒有這個檔案的
會提示輸入金鑰

認證&&授權

ballerina 的 http 服務可以配置的方式增強認證以及授權，ballerina 支援jwt 以及basic 模式的認證，
使用basic模式時，使用者資訊可以通過配置檔案載入，同時推薦使用https 方式進行資料訪問，增強
安全性

• jwt 認證
  可以通過http:AuthProvider 進行配置
  參考

import ballerina/http;

http:AuthProvider jwtAuthProvider = {
   scheme:"jwt",
   issuer:"ballerina",
   audience: "ballerina.io",
   clockSkew:10,
   certificateAlias: "ballerina",
   trustStore: {
       path: "${ballerina.home}/bre/security/ballerinaTruststore.p12",
       password: "ballerina"
   }
};

endpoint http:SecureListener secureHelloWorldEp {
   port:9091,
   authProviders:[jwtAuthProvider],
   secureSocket: {
       keyStore: {
           path: "${ballerina.home}/bre/security/ballerinaKeystore.p12",
           password: "ballerina"
       }
   }
};

@http:ServiceConfig {
   basePath:"/hello"
}
service<http:Service> helloWorld bind secureHelloWorldEp {

   @http:ResourceConfig {
       methods:["GET"],
       path:"/"
   }
   sayHello (endpoint caller, http:Request req) {
       http:Response resp = new;
       resp.setTextPayload("Hello, World!");
       _ = caller->respond(resp);
   }
}

• http basic 認證
  參考程式碼

import ballerina/http;

http:AuthProvider basicAuthProvider = {
   scheme:"basic",
   authStoreProvider:"config"
};

endpoint http:SecureListener secureHelloWorldEp {
   port:9091,
   authProviders:[basicAuthProvider],
   secureSocket: {
       keyStore: {
           path: "${ballerina.home}/bre/security/ballerinaKeystore.p12",
           password: "ballerina"
       }
   }
};

@http:ServiceConfig {
   basePath:"/hello",
   authConfig:{
      scopes:["hello"]
   }
}
service<http:Service> helloWorld bind secureHelloWorldEp {

   @http:ResourceConfig {
       methods:["GET"],
       path:"/"
   }
   sayHello (endpoint caller, http:Request req) {
       http:Response resp = new;
       resp.setTextPayload("Hello, World!");
       _ = caller->respond(resp);
   }
}

使用者賬戶配置資訊(通過配置檔案)

sample-users.toml

["b7a.users"]

["b7a.users.generalUser"]
password="@encrypted:{pIQrB9YfCQK1eIWH5d6UaZXA3zr+60JxSBcpa2PY7a8=}"

["b7a.users.admin"]
password="@encrypted:{pIQrB9YfCQK1eIWH5d6UaZXA3zr+60JxSBcpa2PY7a8=}"
scopes="hello"

載入配置

ballerina run --config sample-users.toml basic_auth_sample.bal

• 說明
  在認證服務的同時，我們可以配置scope，指定許可權範圍，還是比較方便的

下游服務的認證

實際上就是在client 端載入認證資訊，方便呼叫

• 一個jwt client 的例子

import ballerina/http;

http:AuthProvider jwtAuthProvider = {
   scheme:"jwt",
   propagateToken: true,
   issuer:"ballerina",
   audience: "ballerina.io",
   clockSkew:10,
   certificateAlias: "ballerina",
   trustStore: {
       path: "${ballerina.home}/bre/security/ballerinaTruststore.p12",
       password: "ballerina"
   }
};

endpoint http:SecureListener secureHelloWorldEp {
   port:9091,
   authProviders:[jwtAuthProvider],
   secureSocket: {
       keyStore: {
           path: "${ballerina.home}/bre/security/ballerinaKeystore.p12",
           password: "ballerina"
       }
   }
};

endpoint http:Client downstreamServiceEP {
   url: "https://localhost:9092",
   auth: { scheme: http:JWT_AUTH },
   secureSocket: {
       trustStore: {
           path: "${ballerina.home}/bre/security/ballerinaTruststore.p12",
           password: "ballerina"
       }
   }
};

@http:ServiceConfig {
   basePath:"/hello",
   authConfig:{
      scopes:["hello"]
   }
}
service<http:Service> helloWorld bind secureHelloWorldEp {

   @http:ResourceConfig {
       methods:["GET"],
       path:"/"
   }
   sayHello (endpoint caller, http:Request req) {
       http:Response response = check downstreamServiceEP->get("/update-stats",
                                                         message = untaint req);
       _ = caller->respond(response);
   }
}

// ----------------------------------------------
// Following code creates the downstream service
// ----------------------------------------------

http:AuthProvider downstreamJwtAuthProvider = {
   scheme:"jwt",
   issuer:"ballerina",
   audience: "ballerina.io",
   clockSkew:10,
   certificateAlias: "ballerina",
   trustStore: {
       path: "${ballerina.home}/bre/security/ballerinaTruststore.p12",
       password: "ballerina"
   }
};

endpoint http:SecureListener secureUpdateServiceEp {
   port:9092,
   authProviders:[downstreamJwtAuthProvider],
   secureSocket: {
       keyStore: {
           path: "${ballerina.home}/bre/security/ballerinaKeystore.p12",
           password: "ballerina"
       }
   }
};

@http:ServiceConfig {
   basePath:"/update-stats"
}
service<http:Service> updateService bind secureUpdateServiceEp {

   @http:ResourceConfig {
       methods:["GET"],
       path:"/"
   }
   updateStats (endpoint caller, http:Request req) {
       http:Response resp = new;
       resp.setTextPayload("Downstream Service Received JWT: " +
                           untaint req.getHeader("Authorization"));
       _ = caller->respond(resp);
   }
}

說明

ballerina 的設計以及功能還是很方便的，功能很齊全。

參考資料