I have a microservice that exposes public API (in this case, HTTP API). Also, we have a bug a production that occurs only for newly registered users. So, QA engineer asks me to add internal endpoint (it is available only for test runners but not the outside world) that deletes the user from the database. It’ll help to reproduce the error and investigate what it causes.
DevOps engineer claims that such practice is not secure because this endpoint might leak to production and it has no authorization.
My suggestions are:
- Cover this endpoint with feature toggle and mark it as enabled only for UAT environment.
- Add token validation and pass it as an environment variable into deployment.
- Do not add any HTTP API but just write an SQL that deletes user from the database. Unfortunately, QA engineer probably won’t be able to execute it during auto-test invocation (DevOps engineer wouldn’t allow it).
What are the best practices there to handle such scenario? The system already have some internal endpoints but they are being invoked by other microservices as part of the business operation. I’d like not to overcomplicate the solution and still not make the system vulnerable.