pennersr/django-healthpoint

Framework for adding an endpoint for health checks to your project.

django-healthpoint's Issues

django-healthpoint throws deprecation warning in Django 3

Warning:

/usr/local/lib/python3.7/site-packages/healthpoint/urls.py:7: RemovedInDjango40Warning: django.conf.urls.url() is deprecated in favor of django.urls.re_path()

Expected behavior:
For Django 3 users, it does not throw this warning.

Potential Denial of Service vunerability

Healthpoint does the health checks first before checking which user is doing the request. After doing the actual health checks it decides whether the results are allowed to be displayed to the user.
When you are doing a request with a staff member or with the special Basic authentication credentials, you will see the results in the response. Otherwise you just get a status code.

The health checks itself can have some latency as checking connectivity to related services (database, object storage etc.) is a typical use case for this package.

When an attacker knows about the health check endpoint it could in theory create a DoS attack by calling the endpoint without any authentication at a high request rate.

There are several ways how to deal with this problem. According to me introducing a single boolean setting to require basic authentication when basic authentication is configured should be sufficient.

Looking forward to feedback on how to handle this. 👍