Lite API access

General API protection principles

External access to BAF Lite is carried out through the gateway pod, which checks for a valid JWT token before proxying requests to the underlying services. This ensures that all services with which the web component interacts are protected, including video-recorder and image-api services.

When accessing services inside the cluster, JWT usage is not required. The image-api services do not protect their APIs, and part of the video-recorder API is protected by an internal token stored in the video-recorder-token secret in the ./cfg/video-recorder.secrets.json file.

JWT token generation

To generate a valid JWT token, the authentification-service module is used.

danger

The authentification-service API does not have its own protection and must not be exposed externally – otherwise an attacker could generate their own tokens. It is assumed that access to the service is only available inside the Kubernetes cluster or through an internal domain.

Token generation request

Request schema: POST /api/v1/jwt/generate

Example request

curl -X 'POST' \
  'http://auth-service.ru/api/v1/jwt/generate' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "expire_time": 500
}'

Request body parameters (application/json)

Parameter	Description
expire_time	Token lifetime in seconds, counted from the moment of the request. Required.

Example request body

{
  "expire_time": 500
}

Example Response

{
  "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJBdXRoZW50aWZpY2F0aW9uU2VydmljZSIsImV4cCI6MTc4NTM1MzM1NiwibmJmIjoxNzg1MzAzMzU2fQ.Zzy-9aSDDhnKqbipAgW9MnZCb2PknSkloHzs2K7BFSavqVWtcs1_YE1aO1Sl4ELnOjF_qN-q0_flDtUCMqOZAQ"
}

Response structure

Field	Description
token	The generated JWT token, which must be passed in the Authorization: Bearer <token> header when accessing protected APIs via the gateway.