Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/grpc-ecosystem/grpc-gateway
The grpc-gateway is a plugin of the Google protocol buffers compiler
protoc.
It reads protobuf service definitions and generates a reverse-proxy server which
translates a RESTful HTTP API into gRPC. This server is generated according to the
google.api.http
annotations in your service definitions.
This helps you provide your APIs in both gRPC and RESTful style at the same time.
We use the gRPC-Gateway to serve millions of API requests per day, and have been since 2018, and through all of that, we have never had any issues with it.
- William Mill, Ad Hoc
gRPC is great -- it generates API clients and server stubs in many programming languages, it is fast, easy-to-use, bandwidth-efficient and its design is combat-proven by Google. However, you might still want to provide a traditional RESTful JSON API as well. Reasons can range from maintaining backward-compatibility, supporting languages or clients that are not well supported by gRPC, to simply maintaining the aesthetics and tooling involved with a RESTful JSON architecture.
This project aims to provide that HTTP+JSON interface to your gRPC service. A small amount of configuration in your service to attach HTTP semantics is all that's needed to generate a reverse-proxy with this library.
The grpc-gateway requires a local installation of the Google protocol buffers
compiler protoc
v3.0.0 or above. Please install this via your local package
manager or by downloading one of the releases from the official repository:
https://github.com/protocolbuffers/protobuf/releases
The following instructions assume you are using Go Modules for dependency management. Use a tool dependency to track the versions of the following executable packages:
// +build tools
package tools
import (
_ "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway"
_ "github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger"
_ "github.com/golang/protobuf/protoc-gen-go"
)
Run go mod tidy
to resolve the versions. Install by running
$ go install \
github.com/grpc-ecosystem/grpc-gateway/protoc-gen-grpc-gateway \
github.com/grpc-ecosystem/grpc-gateway/protoc-gen-swagger \
github.com/golang/protobuf/protoc-gen-go
This will place three binaries in your $GOBIN
;
protoc-gen-grpc-gateway
protoc-gen-swagger
protoc-gen-go
Make sure that your $GOBIN
is in your $PATH
.
Define your gRPC service using protocol buffers
your_service.proto
:
syntax = "proto3";
package example;
message StringMessage {
string value = 1;
}
service YourService {
rpc Echo(StringMessage) returns (StringMessage) {}
}
Generate gRPC stubs
This step generates the gRPC stubs that you can use to implement the service and consume from clients:
Here's an example of what a protoc
command might look like to generate Go stubs:
protoc -I . --go_out ./gen/go/ --go_opt plugins=grpc --go_opt paths=source_relative your/service/v1/your_service.proto
Implement your service in gRPC as usual
For example, the following generates gRPC code for Ruby based on your/service/v1/your_service.proto
:
protoc -I . --ruby_out ./gen/ruby your/service/v1/your_service.proto
protoc -I . --grpc-ruby_out ./gen/ruby your/service/v1/your_service.proto
Generate reverse-proxy using protoc-gen-grpc-gateway
At this point, you have 3 options:
.proto
file, but will not allow setting HTTP paths, request parameters or similar.proto
modifications to use a custom mapping
.proto
file to set custom HTTP mappings.proto
modifications, but use an external configuration file
relies on an external configuration file to set custom HTTP mappings
mostly useful when the source proto file isn't under your control
This requires no additional modification to the .proto
file, but does require enabling a specific option when executing the plugin.
The generate_unbound_methods
should be enabled.
Here's what a protoc
execution might look like with this option enabled:
protoc -I . --grpc-gateway_out ./gen/go \
--grpc-gateway_opt logtostderr=true \
--grpc-gateway_opt paths=source_relative \
--grpc-gateway_opt generate_unbound_methods=true \
your/service/v1/your_service.proto
Add a google.api.http
annotation to your .proto file
your_service.proto
:
syntax = "proto3";
package example;
+
+import "google/api/annotations.proto";
+
message StringMessage {
string value = 1;
}
service YourService {
- rpc Echo(StringMessage) returns (StringMessage) {}
+ rpc Echo(StringMessage) returns (StringMessage) {
+ option (google.api.http) = {
+ post: "/v1/example/echo"
+ body: "*"
+ };
+ }
}
You will need to provide the required third party protobuf files to the
protoc
compiler. They are included in this repo under thethird_party/googleapis
folder, and we recommend copying them into yourprotoc
generation file structure. If you've structured your proto files according to something like the Buf style guide, you could copy the files into a top-level
See a_bit_of_everything.proto for examples of more annotations you can add to customize gateway behavior and generated Swagger output.
Here's what a protoc
execution might look like:
protoc -I . --grpc-gateway_out ./gen/go \
--grpc-gateway_opt logtostderr=true \
--grpc-gateway_opt paths=source_relative \
your/service/v1/your_service.proto
Here's what a protoc
execution might look like with this option enabled:
protoc -I . --grpc-gateway_out ./gen/go \
--grpc-gateway_opt logtostderr=true \
--grpc-gateway_opt paths=source_relative \
--grpc-gateway_opt grpc_api_configuration=path/to/config.yaml \
your/service/v1/your_service.proto
Write an entrypoint for the HTTP reverse-proxy server
package main
import (
"context"
"flag"
"net/http"
"github.com/golang/glog"
"github.com/grpc-ecosystem/grpc-gateway/runtime"
"google.golang.org/grpc"
gw "github.com/yourorg/yourrepo/proto/gen/go/your/service/v1/your_service" // Update
)
var (
// command-line options:
// gRPC server endpoint
grpcServerEndpoint = flag.String("grpc-server-endpoint", "localhost:9090", "gRPC server endpoint")
)
func run() error {
ctx := context.Background()
ctx, cancel := context.WithCancel(ctx)
defer cancel()
// Register gRPC server endpoint
// Note: Make sure the gRPC server is running properly and accessible
mux := runtime.NewServeMux()
opts := []grpc.DialOption{grpc.WithInsecure()}
err := gw.RegisterYourServiceHandlerFromEndpoint(ctx, mux, *grpcServerEndpoint, opts)
if err != nil {
return err
}
// Start HTTP server (and proxy calls to gRPC server endpoint)
return http.ListenAndServe(":8081", mux)
}
func main() {
flag.Parse()
defer glog.Flush()
if err := run(); err != nil {
glog.Fatal(err)
}
}
(Optional) Generate swagger definitions using protoc-gen-swagger
protoc -I . --swagger_out ./gen/swagger --swagger_opt logtostderr=true your/service/v1/your_service.proto
Note that this plugin also supports generating swagger definitions for unannotated methods; use the generate_unbound_methods
option to enable this.
This GopherCon UK 2019 presentation from our maintainer @JohanBrandhorst provides a good intro to using the grpc-gateway. It uses the following boilerplate repo as a base: https://github.com/johanbrandhorst/grpc-gateway-boilerplate.
During code generation with protoc
, flags to grpc-gateway tools must be passed
through protoc using one of 2 patterns:
--<tool_suffix>_out
protoc
parameter: --<tool_suffix>_out=<flags>:<path>
--grpc-gateway_out=logtostderr=true,repeated_path_param_separator=ssv:.
--swagger_out=logtostderr=true,repeated_path_param_separator=ssv:.
--<tool_suffix>_opt
parameters: --<tool_suffix>_opt=<flag>[,<flag>]*
--grpc-gateway_opt logtostderr=true,repeated_path_param_separator=ssv
# or separately
--grpc-gateway_opt logtostderr=true --grpc-gateway_opt repeated_path_param_separator=ssv
--swagger_opt logtostderr=true,repeated_path_param_separator=ssv
# or separately
--swagger_opt logtostderr=true --swagger_opt repeated_path_param_separator=ssv
protoc-gen-grpc-gateway
supports custom mapping from Protobuf import
to
Golang import paths. They are compatible with
the parameters with the same names in protoc-gen-go
.
In addition we also support the request_context
parameter in order to use the
http.Request
's Context (only for Go 1.7 and above). This parameter can be
useful to pass the request-scoped context between the gateway and the gRPC service.
protoc-gen-grpc-gateway
also supports some more command line flags to control
logging. You can give these flags together with parameters above. Run
protoc-gen-grpc-gateway --help
for more details about the flags.
Similarly, protoc-gen-swagger
supports command-line flags to control Swagger
output (for example, json_names_for_fields
to output JSON names for fields
instead of protobuf names). Run protoc-gen-swagger --help
for more flag
details. Further Swagger customization is possible by annotating your .proto
files with options from
openapiv2.proto - see
a_bit_of_everything.proto
for examples.
More examples are available under examples
directory.
proto/examplepb/echo_service.proto
, proto/examplepb/a_bit_of_everything.proto
, proto/examplepb/unannotated_echo_service.proto
: service definition
proto/examplepb/echo_service.pb.go
, proto/examplepb/a_bit_of_everything.pb.go
, proto/examplepb/unannotated_echo_service.pb.go
: [generated] stub of the serviceproto/examplepb/echo_service.pb.gw.go
, proto/examplepb/a_bit_of_everything.pb.gw.go
, proto/examplepb/uannotated_echo_service.pb.gw.go
: [generated] reverse proxy for the serviceproto/examplepb/unannotated_echo_service.yaml
: gRPC API Configuration for unannotated_echo_service.proto
server/main.go
: service implementationmain.go
: entrypoint of the generated reverse proxyTo use the same port for custom HTTP handlers (e.g. serving swagger.json
),
gRPC-gateway, and a gRPC server, see
this example by CoreOS
(and its accompanying blog post).
Grpc-Metadata-
prefix to gRPC metadata (prefixed with grpcgateway-
)Grpc-Timeout
header.But patch is welcome.
X-Forwarded-For
gRPC request header.X-Forwarded-Host
gRPC request header.Authorization
header is added as authorization
gRPC request header.grpcgateway-
and added with their values to gRPC request
header.grpcgateway-
).OrigName: true
.See CONTRIBUTING.md.
grpc-gateway is licensed under the BSD 3-Clause License. See LICENSE.txt for more details.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.