Skip to main content

Configure Authenticated HTTP Input

This step configures a rate-limited HTTP server with an API-key check and CORS for browser-based clients. The wildcard CORS origin is a permissive demonstration setting, not a deployment security baseline.

Goal​

Create an HTTP entry point for log ingestion that:

  • Authenticates clients using API keys
  • Rate limits requests to prevent abuse
  • Validates request size and timeouts
  • Handles CORS for browser-based logging

Configuration​

We'll use the http_server input with authentication and performance tuning settings.

1. Basic HTTP Server​

First, let's define the basic server structure listening on port 8080.

Partial snippet
input:
  http_server:
    address: '0.0.0.0:8080'
    path: /logs/ingest
    timeout: 10s

2. Add Request Controls​

Add these CORS settings under input.http_server.

Partial snippet
# Browser access policy (permissive demo setting)
cors:
  enabled: true
  allowed_origins: ['*']

Use input processors to check the API key before a message reaches the pipeline. Replace the basic input with this configuration, including the CORS settings above. Rejected requests receive a synchronous 401 response and their messages are deleted.

Partial snippet
input:
  http_server:
    address: '0.0.0.0:8080'
    path: /logs/ingest
    timeout: 10s
    allowed_verbs: ['POST']
    cors:
      enabled: true
      allowed_origins: ['*']
    sync_response:
      status: '${! meta("http_status").or("200") }'
  processors:
    - switch:
        - check: 'env("LOG_API_KEY").or("") == "" || meta("X-Api-Key").or("") != env("LOG_API_KEY").or("")'
          processors:
            - mapping: |
                meta http_status = "401"
                root = {"error": "Unauthorized"}
            - sync_response: {}
            - mapping: root = deleted()

3. Performance & Protection​

Finally, we add rate limiting and size constraints to protect the pipeline.

Apply the authenticated input above to the complete reference, retaining its named rate-limit resource, processors, and failure boundary.

Complete Step 1 Configuration​

Combine these into a single configuration file.

See the complete reference for the maintained input, named rate-limit resource, processors, and failure boundary.

Deployment & Verification​

  1. Set the API Key:

    export LOG_API_KEY="secret-key-123"

  2. Test Access (Success):

    curl -X POST http://localhost:8080/logs/ingest \
      -H "X-API-Key: secret-key-123" \
      -d '{"message": "hello"}'

    Expected: 200 OK

  3. Test Access (Failure - Wrong Key):

    curl -X POST http://localhost:8080/logs/ingest \
      -H "X-API-Key: wrong-key" \
      -d '{"message": "hello"}'

    Expected: 401 Unauthorized

Next Steps​

Now that the input checks an API key, validate the data that passes through it.

👉 Step 2: Parse & Validate Logs