Purpose of /configuration and /outputcache/{region} endpoints

[b-shep]

Follow up on issue #989. I'm curious as to what the purpose is of the /configuration and /outputcache/{region} endpoints?

The existence of these endpoints wasn't even realized by my team until they showed up in swagger and there's no mention of them in any of the documentation I can find. They only seem to return 404, but still curious about insight onto why they exist.

Specifically my concern is that given Ocelot is typically public facing, doesn't having exposed endpoints (especially for global configuration and routes) represent a security risk?

Thanks in advance for any help/clarification!

[raman-m]

Hi @b-shep !
Welcome to Ocelot world! 🐯
And sorry for the 2+ years late reply...

---

I'm curious as to what the purpose is of the /configuration and /outputcache/{region} endpoints?

Well... In Administration API section everything is described! Ask us once again if something is unclear.
Click the links above: read the docs!

---

The existence of these endpoints wasn't even realized by my team until they showed up in swagger and there's no mention of them in any of the documentation I can find.

Ok. Sometimes it happens when undocumented feature is uncovered by you. This is bad for sure. Personally I found 3 undocumented features in Ocelot during last 6 months. It happened when PR is merged without docs, so docs weren't updated. As a project coordinator, I require writing docs for all new features, or feature updating possibly requires docs updating too. This is a part of our current development process.
I'm sorry that you were confused by undocumented feature.

---

They only seem to return 404, but still curious about insight onto why they exist.

Those requests were unauthorized! You had to get access JWT token first to communicate to Ocelot Admin API.

---

Specifically my concern is that given Ocelot is typically public facing, doesn't having exposed endpoints (especially for global configuration and routes) represent a security risk?

There is no risk because in order to communicate to Administration API endpoints you have to create auth JWT token by internal or external Identity Server.
The risks are the same as for every public website on internet.
There are the best practices to eliminate sec risks:

• Use https protocol to host Ocelot instance to encrypt data
• Use short life time tokens with expiration always: short expiry is better
• Use Ocelot deployments in private networks with VPN server. This will require to open VPN tunnel for all clients which communicate to Ocelot instance including Administration API. This is the most secured environment setup.

Hope it helps!