Elsa v3: Secure Http trigger APIs (paths) for workflow execution

[abhjitsantra]

I have setup ELSA server to use default authentication. I have not enabled admin API key and admin credentials. When I try to invoke APIs e.g. /workflow-definitions, it expects a valid Bearer token or API key to be sent as part of the Authorization header of the request, otherwise it returns 401 error response. If I try to trigger a workflow via http trigger, I can do that without any Authorization header and it succeeds. Not sure if it happens in localhost env only.

[sfmskywalker]

Hi @abhjitsantra ,

In order to protect HTTP Endpoint workflows, you need to do two things:

1. Configure the Elsa HTTP feature to use the AuthenticationBasedHttpEndpointAuthorizationHandler strategy for its authorization handler. By default, the AllowAnonymousHttpEndpointAuthorizationHandler strategy is used.
2. On the HTTP Endpoint activity itself, there's a checkbox called "Authorize" - make sure to tock this box and then publish your changes.

For step 1, you can configure the desired strategy as follows from Program.cs:

services.AddElsa(elsa =>
{
   elsa.UseHttp(http =>
   {
       http.HttpEndpointAuthorizationHandler = sp => sp.GetRequiredService<AuthenticationBasedHttpEndpointAuthorizationHandler>();
   });
}