Does roadie scaffolder-backend-module-http-request support authorization in headers?

[subash54]

Hi Team I am using roadie scaffolder-backend-module-http-request to call api which has authentication

 - id: backstage_request_with_input
      name: backstage request
      action: http:backstage:request
      input:
        method: 'GET'
        path: '/api/proxy/sheet/test'
      headers:
        Authorization: 'Basic c3ViYXNoOmhlbGxv'

The above is the body that I am passing but I am getting unauthorized while passing authorization in headers.

In Postman for the same I am able to send the request.

Whether it supports passing authorization in headers.

Can anyone help me in this?

[kissmikijr]

No, we do not support the header overwrite. You should be able to call APIs behind authentication with the proxy. As in your example it already calls the proxy, you can setup your authorization headers in the proxy, you the backend will have the correct credentials when it forwards the request

[dfl-aeb]

It’s mentioned that overriding headers (like authentication) isn’t supported, and the recommendation is to configure authentication headers directly in the proxy. While this ensures the correct credentials are sent, how is access control for these proxies envisioned?

For example, if a proxy is configured with sensitive tokens to perform actions like renaming repositories or setting metadata, anyone with access to the Backstage backend could potentially call /api/proxy/{endpoint} and misuse the credentials to perform unauthorized actions.

How do you handle permission control for such proxy endpoints to ensure only authorized users or plugins can access them? Are there any plans to improve this, or is a custom backend plugin with stricter access rules the preferred solution?