Require authentication for Forge analytics report endpoint by jamesfredley · Pull Request #15814 · apache/grails-core

jamesfredley · 2026-07-02T22:46:24Z

The Forge analytics POST /analytics/report endpoint previously accepted unauthenticated writes, allowing anyone to inject fabricated project-generation statistics into the analytics database.

Changes

Authenticate POST /analytics/report with a Google-issued bearer JWT, validated by:
- signature via Google JWKS (https://www.googleapis.com/oauth2/v3/certs)
- iss = https://accounts.google.com
- �ud = the analytics Cloud Run URL (GRAILS_FORGE_ANALYTICS_AUDIENCE)
- sub pinned to the Forge web service account's unique id via a new AnalyticsCallerJwtClaimsValidator (GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT)
Public read endpoints (GET /top/*) remain explicitly anonymous (@secured(IS_ANONYMOUS)).
HSTS response filter added to the Forge web (Netty) app, enabled by default and configurable.
Deploy wiring: Cloud Run deploy workflows now set GRAILS_FORGE_ANALYTICS_AUDIENCE on both caller and receiver and compute GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT from the deployed service account; README documents the new env vars.

Tests

AnalyticsControllerSecuritySpec (no Docker): unauthenticated POST -> 401, wrong-audience token -> 401, wrong-caller-subject token -> 401, public GET not rejected as unauthenticated.
HstsHeaderFilterSpec: verifies the Strict-Transport-Security header is applied.
StoreGeneratedProjectStatsSpec updated to send an authorized bearer token.

Both focused specs pass locally.

The Forge analytics `POST /analytics/report` endpoint previously accepted unauthenticated writes, letting anyone inject fabricated project-generation statistics. Secure it with a Google-issued bearer JWT that is validated by signature (Google JWKS), issuer, audience, and a caller-subject claim pinned to the Forge web service account's unique id, so only the intended caller can report analytics. Public read endpoints (`GET /top/*`) stay anonymous. Also add an HSTS response filter to the Forge web (Netty) app and wire the analytics audience and caller-subject env vars through the Cloud Run deploy workflows and README. Assisted-by: claude-code:claude-opus-4-8

Copilot

Pull request overview

This PR hardens the Grails Forge analytics ingestion path by requiring authenticated writes to POST /analytics/report (preventing unauthenticated injection of fabricated stats), while keeping the “top/*” read endpoints publicly accessible. It also adds an HSTS response filter to the Forge web Netty service and wires new env vars through Cloud Run deploy workflows and documentation.

Changes:

Require bearer JWT authentication for POST /analytics/report, and explicitly mark GET /analytics/top/* endpoints as anonymous.
Add an (enabled-by-default, configurable) HSTS response filter to the Forge web Netty app, with a new spec verifying the header.
Update deploy workflows + README to provide GRAILS_FORGE_ANALYTICS_AUDIENCE and GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
grails-forge/README.md	Documents new analytics auth env vars for Forge + analytics services.
grails-forge/grails-forge-web-netty/src/test/groovy/org/grails/forge/netty/security/HstsHeaderFilterSpec.groovy	Adds test coverage verifying the HSTS header is applied.
grails-forge/grails-forge-web-netty/src/main/resources/application.yml	Introduces HSTS config defaults and passes analytics audience config to the GCP HTTP client auth config.
grails-forge/grails-forge-web-netty/src/main/java/org/grails/forge/netty/security/HstsHeaderFilter.java	Adds a global response filter that sets `Strict-Transport-Security` when enabled.
grails-forge/grails-forge-web-netty/build.gradle	Adds Groovy/Spock test dependencies needed for the new Spock spec.
grails-forge/grails-forge-analytics-postgres/src/test/groovy/org/grails/forge/analytics/postgres/StoreGeneratedProjectStatsSpec.groovy	Updates integration-style test to send an authorized bearer token.
grails-forge/grails-forge-analytics-postgres/src/test/groovy/org/grails/forge/analytics/postgres/AnalyticsControllerSecuritySpec.groovy	Adds security-focused tests for rejecting unauthenticated/invalid tokens and allowing anonymous reads.
grails-forge/grails-forge-analytics-postgres/src/main/resources/application.yml	Enables bearer JWT auth + Google JWKS verification config and configures caller subject pinning.
grails-forge/grails-forge-analytics-postgres/src/main/java/org/grails/forge/analytics/postgres/AnalyticsController.java	Secures the report endpoint and explicitly allows anonymous access to read endpoints.
grails-forge/grails-forge-analytics-postgres/src/main/java/org/grails/forge/analytics/postgres/AnalyticsCallerJwtClaimsValidator.java	Adds a custom JWT claims validator to pin `sub` to the expected caller subject.
grails-forge/grails-forge-analytics-postgres/build.gradle	Adds Micronaut JWT security dependency and Groovy/Spock test dependencies.
.github/workflows/forge-deploy-snapshot.yml	Wires `GRAILS_FORGE_ANALYTICS_AUDIENCE` and sets `GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT` for analytics deployment.
.github/workflows/forge-deploy-release.yml	Wires `GRAILS_FORGE_ANALYTICS_AUDIENCE` and sets `GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT` for analytics deployment (latest + versioned).
.github/workflows/forge-deploy-prev.yml	Wires `GRAILS_FORGE_ANALYTICS_AUDIENCE` and sets `GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT` for analytics deployment.
.github/workflows/forge-deploy-prev-snapshot.yml	Wires `GRAILS_FORGE_ANALYTICS_AUDIENCE` and sets `GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT` for analytics deployment.
.github/workflows/forge-deploy-next.yml	Wires `GRAILS_FORGE_ANALYTICS_AUDIENCE` and sets `GRAILS_FORGE_ANALYTICS_CALLER_SUBJECT` for analytics deployment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    @MockBean(ApplicationRepository)
+    @NonNull
+    ApplicationRepository applicationRepository() {
+        Mock(ApplicationRepository)
+    }
+
+    @MockBean(JdbcOperations)
+    @NonNull
+    JdbcOperations jdbcOperations() {
+        Mock(JdbcOperations)
+    }


+    void 'top analytics data is not rejected as unauthenticated'() {
+        when:
+        client.toBlocking().exchange(HttpRequest.GET('/top/features'), String)
+
+        then:
+        HttpClientResponseException e = thrown(HttpClientResponseException)
+        e.status == HttpStatus.INTERNAL_SERVER_ERROR
+        0 * applicationRepository._
+    }


jdaugherty · 2026-07-07T15:45:38Z

    }

    @Get("/top/features")
+    @Secured(SecurityRule.IS_ANONYMOUS)


I'm confused - these indicate they're anonymous but your'e requiring authentication?

@jamesfredley isn't the point of this to ensure we're authenticated? Shouldn't all of these IS_ANONYMOUS be removed for the analytics endpoint?

Assisted-by: opencode:gpt-5.5

codecov · 2026-07-09T20:00:06Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.3657%. Comparing base (66cd24c) to head (fa5214f).
⚠️ Report is 5488 commits behind head on 8.0.x.

Additional details and impacted files

@@                Coverage Diff                 @@
##                8.0.x     #15814        +/-   ##
==================================================
- Coverage     49.4842%   49.3657%   -0.1185%     
- Complexity      16697      16782        +85     
==================================================
  Files            1947       1986        +39     
  Lines           92474      93336       +862     
  Branches        16152      16337       +185     
==================================================
+ Hits            45760      46076       +316     
- Misses          39606      40135       +529     
- Partials         7108       7125        +17

see 171 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

testlens-app · 2026-07-09T20:47:51Z

✅ All tests passed ✅

🏷️ Commit: fa5214f
▶️ Tests: 9499 executed
⚪️ Checks: 59/59 completed

Learn more about TestLens at testlens.app.

jdaugherty · 2026-07-09T21:09:23Z

The tests are failing to authenticate:

AnalyticsControllerSecuritySpec > top analytics data is not rejected as unauthenticated FAILED
io.micronaut.http.client.exceptions.HttpClientResponseException at DefaultHttpClient.java:2177

StoreGeneratedProjectStatsSpec > test save generation data FAILED
io.micronaut.http.client.exceptions.HttpClientResponseException at DefaultHttpClient.java:2177

Copilot AI review requested due to automatic review settings July 2, 2026 22:46

github-project-automation Bot added this to Apache Grails Jul 2, 2026

Copilot started reviewing on behalf of jamesfredley July 2, 2026 22:46 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

jdaugherty reviewed Jul 7, 2026

View reviewed changes

jamesfredley added the ai-generated-starting-point label Jul 8, 2026

Clarify Forge analytics endpoint security

fa5214f

Assisted-by: opencode:gpt-5.5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Require authentication for Forge analytics report endpoint#15814

Require authentication for Forge analytics report endpoint#15814
jamesfredley wants to merge 2 commits into
8.0.xfrom
fix/forge-analytics-security

jamesfredley commented Jul 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jdaugherty Jul 7, 2026

Uh oh!

jdaugherty Jul 9, 2026

Uh oh!

codecov Bot commented Jul 9, 2026

Uh oh!

testlens-app Bot commented Jul 9, 2026

Uh oh!

jdaugherty commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

jamesfredley commented Jul 2, 2026

Changes

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jdaugherty Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

jdaugherty Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 9, 2026

Codecov Report

Uh oh!

testlens-app Bot commented Jul 9, 2026

✅ All tests passed ✅

Uh oh!

jdaugherty commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants