[ts-http-runtime] Allow insecure bearer token policy

sdk/core/ts-http-runtime/review/ts-http-runtime.api.md

@@ -92,6 +92,7 @@ export const bearerTokenAuthenticationPolicyName = "bearerTokenAuthenticationPol
 
 // @public
 export interface BearerTokenAuthenticationPolicyOptions {
+    allowInsecureConnection?: boolean;
     challengeCallbacks?: ChallengeCallbacks;
     credential?: TokenCredential;
     logger?: TypeSpecRuntimeLogger;

sdk/core/ts-http-runtime/src/client/clientHelpers.ts

@@ -45,6 +45,7 @@ export function addCredentialPipelinePolicy(
     const tokenPolicy = bearerTokenAuthenticationPolicy({
       credential,
       scopes: clientOptions?.credentials?.scopes ?? `${endpoint}/.default`,
+      allowInsecureConnection: clientOptions?.allowInsecureConnection ?? false,
     });
     pipeline.addPolicy(tokenPolicy);
   } else if (isKeyCredential(credential)) {

sdk/core/ts-http-runtime/src/policies/bearerTokenAuthenticationPolicy.ts

@@ -2,11 +2,12 @@
 // Licensed under the MIT license.
 
 import { AccessToken, GetTokenOptions, TokenCredential } from "../auth/tokenCredential.js";
-import { TypeSpecRuntimeLogger } from "../logger/logger.js";
 import { PipelineRequest, PipelineResponse, SendRequest } from "../interfaces.js";
+
 import { PipelinePolicy } from "../pipeline.js";
-import { createTokenCycler } from "../util/tokenCycler.js";
+import { TypeSpecRuntimeLogger } from "../logger/logger.js";
 import { logger as coreLogger } from "../log.js";
+import { createTokenCycler } from "../util/tokenCycler.js";
 
 /**
  * The programmatic identifier of the bearerTokenAuthenticationPolicy.
@@ -100,6 +101,11 @@ export interface BearerTokenAuthenticationPolicyOptions {
    * A logger can be sent for debugging purposes.
    */
   logger?: TypeSpecRuntimeLogger;
+  /**
+   * Allows for connecting to HTTP endpoints instead of enforcing HTTPS.
+   * CAUTION: Never use this option in production.
+   */
+  allowInsecureConnection?: boolean;
 }
 
 /**
@@ -130,6 +136,47 @@ function getChallenge(response: PipelineResponse): string | undefined {
   return;
 }
 
+/**
+ * Checks if the request is allowed to be sent over an insecure connection.
+ *
+ * A request is allowed to be sent over an insecure connection when:
+ * - The `allowInsecureConnection` option is set to `true`.
+ * - The request has the `allowInsecureConnection` property set to `true`.
+ * - The request is being sent to `localhost` or `127.0.0.1`
+ */
+function allowInsecureConnection(
+  request: PipelineRequest,
+  options: BearerTokenAuthenticationPolicyOptions,
+): boolean {
+  if (options.allowInsecureConnection && request.allowInsecureConnection) {
+    const url = new URL(request.url);
+    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Logs a warning about sending a bearer token over an insecure connection.
+ *
+ * This function will emit a node warning once, but log the warning every time.
+ */
+function emitInsecureConnectionWarning(): void {
+  const warning =
+    "Sending bearer token over insecure transport. Assume any token issued is compromised.";
+
+  coreLogger.warning(warning);
+
+  if (typeof process?.emitWarning === "function" && !emitInsecureConnectionWarning.warned) {
+    emitInsecureConnectionWarning.warned = true;
+    process.emitWarning(warning);
+  }
+}
+
+emitInsecureConnectionWarning.warned = false; // Prime TypeScript to allow the property. Used to only emit warning once.
+
 /**
  * A policy that can request a token from a TokenCredential implementation and
  * then apply it to the Authorization header of a request as a Bearer token.
@@ -171,9 +218,13 @@ export function bearerTokenAuthenticationPolicy(
      */
     async sendRequest(request: PipelineRequest, next: SendRequest): Promise<PipelineResponse> {
       if (!request.url.toLowerCase().startsWith("https://")) {
-        throw new Error(
-          "Bearer token authentication is not permitted for non-TLS protected (non-https) URLs.",
-        );
+        if (allowInsecureConnection(request, options)) {
+          emitInsecureConnectionWarning();
+        } else {
+          throw new Error(
+            "Bearer token authentication is not permitted for non-TLS protected (non-https) URLs.",
+          );
+        }
       }
 
       await callbacks.authorizeRequest({

sdk/core/ts-http-runtime/test/bearerTokenAuthenticationPolicy.spec.ts

@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 
-import { describe, it, assert, expect, vi, beforeEach, afterEach } from "vitest";
 import { AccessToken, TokenCredential } from "../src/auth/tokenCredential.js";
 import {
   AuthorizeRequestOnChallengeOptions,
@@ -12,6 +11,8 @@ import {
   createHttpHeaders,
   createPipelineRequest,
 } from "../src/index.js";
+import { afterEach, assert, beforeEach, describe, expect, it, vi } from "vitest";
+
 import { DEFAULT_CYCLER_OPTIONS } from "../src/util/tokenCycler.js";
 
 const { refreshWindowInMs: defaultRefreshWindow } = DEFAULT_CYCLER_OPTIONS;
@@ -310,11 +311,114 @@ describe("BearerTokenAuthenticationPolicy", function () {
     assert.equal(error?.message, "Failed to refresh access token.");
   });
 
+  describe("when allowInsecureConnection is set", async function () {
+    it("Adds a bearer token against a localhost HTTP URL", async function () {
+      const mockToken = "token";
+      const tokenScopes = ["scope1", "scope2"];
+      const fakeGetToken = vi
+        .fn()
+        .mockResolvedValue({ token: mockToken, expiresOnTimestamp: new Date().getTime() });
+      const mockCredential: TokenCredential = {
+        getToken: fakeGetToken,
+      };
+
+      const request = createPipelineRequest({
+        url: "http://localhost:8080",
+        allowInsecureConnection: true,
+      });
+      const successResponse: PipelineResponse = {
+        headers: createHttpHeaders(),
+        request,
+        status: 200,
+      };
+      const next = vi.fn<Parameters<SendRequest>, ReturnType<SendRequest>>();
+      next.mockResolvedValue(successResponse);
+
+      const bearerTokenAuthPolicy = createBearerTokenPolicy(tokenScopes, mockCredential, {
+        allowInsecureConnection: true,
+      });
+      await bearerTokenAuthPolicy.sendRequest(request, next);
+
+      expect(fakeGetToken).toHaveBeenCalledWith(tokenScopes, {
+        abortSignal: undefined,
+        tracingOptions: undefined,
+      });
+      assert.strictEqual(request.headers.get("Authorization"), `Bearer ${mockToken}`);
+    });
+
+    it("Adds a bearer token against a loopback IP address", async function () {
+      const mockToken = "token";
+      const tokenScopes = ["scope1", "scope2"];
+      const fakeGetToken = vi
+        .fn()
+        .mockResolvedValue({ token: mockToken, expiresOnTimestamp: new Date().getTime() });
+      const mockCredential: TokenCredential = {
+        getToken: fakeGetToken,
+      };
+
+      const request = createPipelineRequest({
+        url: "http://127.0.0.1:8080/some/other/path",
+        allowInsecureConnection: true,
+      });
+      const successResponse: PipelineResponse = {
+        headers: createHttpHeaders(),
+        request,
+        status: 200,
+      };
+      const next = vi.fn<Parameters<SendRequest>, ReturnType<SendRequest>>();
+      next.mockResolvedValue(successResponse);
+
+      const bearerTokenAuthPolicy = createBearerTokenPolicy(tokenScopes, mockCredential, {
+        allowInsecureConnection: true,
+      });
+      await bearerTokenAuthPolicy.sendRequest(request, next);
+
+      expect(fakeGetToken).toHaveBeenCalledWith(tokenScopes, {
+        abortSignal: undefined,
+        tracingOptions: undefined,
+      });
+      assert.strictEqual(request.headers.get("Authorization"), `Bearer ${mockToken}`);
+    });
+
+    it("Throws an error when the URL is not localhost or loopback", async function () {
+      const mockToken = "token";
+      const tokenScopes = ["scope1", "scope2"];
+      const fakeGetToken = vi
+        .fn()
+        .mockResolvedValue({ token: mockToken, expiresOnTimestamp: new Date().getTime() });
+      const mockCredential: TokenCredential = {
+        getToken: fakeGetToken,
+      };
+
+      const request = createPipelineRequest({
+        url: "http://non-local-url.com:8080/",
+        allowInsecureConnection: true,
+      });
+
+      const successResponse: PipelineResponse = {
+        headers: createHttpHeaders(),
+        request,
+        status: 200,
+      };
+      const next = vi.fn<Parameters<SendRequest>, ReturnType<SendRequest>>();
+      next.mockResolvedValue(successResponse);
+
+      const bearerTokenAuthPolicy = createBearerTokenPolicy(tokenScopes, mockCredential, {
+        allowInsecureConnection: true,
+      });
+      await expect(bearerTokenAuthPolicy.sendRequest(request, next)).rejects.toThrowError(
+        /Bearer token authentication is not permitted/,
+      );
+    });
+  });
+
   function createBearerTokenPolicy(
     scopes: string | string[],
     credential: TokenCredential,
+    options?: { allowInsecureConnection?: boolean },
   ): PipelinePolicy {
     return bearerTokenAuthenticationPolicy({
+      ...options,
       scopes,
       credential,
     });