Automatically validate DAPR HTTP middleware configuration files. Checks for correct middleware types, proper secret references, pipeline ordering, and security best practices. Use when configuring OAuth2, Bearer tokens, OPA policies, rate limiting, or other middleware.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Instruções da origem · Visualização somente leitura
name
dapr-middleware-validator
description
Automatically validate DAPR HTTP middleware configuration files. Checks for correct middleware types, proper secret references, pipeline ordering, and security best practices. Use when configuring OAuth2, Bearer tokens, OPA policies, rate limiting, or other middleware.
allowed-tools
Read, Grep, Glob
DAPR Middleware Configuration Validator
This skill validates DAPR HTTP middleware components for security and correctness.
When to Use
Claude automatically uses this skill when:
A middleware YAML file is created or modified
User configures OAuth2, Bearer, OPA, or rate limiting
Pipeline configuration is being set up
Before deploying middleware-protected APIs
Middleware Types
Authentication Middleware
Type
Component Type
Purpose
OAuth2
middleware.http.oauth2
Authorization Code flow
OAuth2 CC
middleware.http.oauth2clientcredentials
Service-to-service auth
Bearer
middleware.http.bearer
JWT/OIDC token validation
Authorization Middleware
Type
Component Type
Purpose
OPA
middleware.http.opa
Policy-based authorization
Traffic Control Middleware
Type
Component Type
Purpose
Rate Limit
middleware.http.ratelimit
Request throttling
Sentinel
middleware.http.sentinel
Circuit breaker/flow control
Request Processing Middleware
Type
Component Type
Purpose
Router Alias
middleware.http.routeralias
Route rewriting
Router Checker
middleware.http.routerchecker
Route validation
WASM
middleware.http.wasm
Custom WebAssembly logic
Uppercase
middleware.http.uppercase
Testing only
Validation Rules
OAuth2 Middleware Validation
apiVersion:dapr.io/v1alpha1kind:Componentmetadata:name:oauth2spec:type:middleware.http.oauth2version:v1metadata:-name:clientIdsecretKeyRef:# REQUIRED: Use secretKeyRefname:oauth-secretskey:client-id-name:clientSecretsecretKeyRef:# REQUIRED: Use secretKeyRefname:oauth-secretskey:client-secret-name:scopesvalue:"openid profile"# REQUIRED-name:authURLvalue:"https://..."# REQUIRED: Must be HTTPS-name:tokenURLvalue:"https://..."# REQUIRED: Must be HTTPS-name:redirectURLvalue:"..."# REQUIRED-name:forceHTTPSvalue:"true"# RECOMMENDED for production
Checks performed:
clientId uses secretKeyRef (not plain value)
clientSecret uses secretKeyRef (not plain value)
authURL uses HTTPS protocol
tokenURL uses HTTPS protocol
forceHTTPS is "true" for production
Bearer Token Validation
spec:type:middleware.http.bearermetadata:-name:audiencevalue:"api://..."# REQUIRED-name:issuervalue:"https://..."# REQUIRED: Must be HTTPS
Plain-text credentials - clientId/clientSecret not in secretKeyRef
HTTP URLs - Auth/token URLs using HTTP instead of HTTPS
Default allow - OPA policy without explicit default deny
No rate limiting - APIs without request throttling
Warnings
Missing forceHTTPS - OAuth2 without HTTPS enforcement
High rate limits - Very permissive request limits
Overly permissive OPA - Policies with broad allow rules
Missing headers - OPA not checking Authorization header
Output Format
DAPR Middleware Validation Report
==================================
✓ components/oauth2-auth.yaml - Valid
- Type: middleware.http.oauth2
- Credentials use secretKeyRef: Yes
- HTTPS enforced: Yes
⚠ components/ratelimit.yaml - Warning
- Type: middleware.http.ratelimit
- Warning: Rate limit of 10000 RPS is very high
- Recommendation: Consider lower limit for public APIs
✗ components/bearer-auth.yaml - Invalid
- Type: middleware.http.bearer
- Error: Missing required field 'audience'
- Error: 'issuer' uses HTTP instead of HTTPS
Pipeline Analysis:
✗ Rate limiting should come BEFORE authentication middleware
Current order: [bearer-auth, ratelimit]
Recommended: [ratelimit, bearer-auth]
Security Summary:
- Critical: 1 (plain-text credentials)
- Warnings: 2
- Valid: 3
Common Issues and Fixes
Plain-Text Credentials
# BAD (security risk)-name:clientSecretvalue:"my-secret-key"# GOOD (use secret reference)-name:clientSecretsecretKeyRef:name:oauth-secretskey:client-secret
HTTP Instead of HTTPS
# BAD (insecure)-name:tokenURLvalue:"http://auth.example.com/token"# GOOD-name:tokenURLvalue:"https://auth.example.com/token"
Default Allow in OPA
# BAD (insecure - allows everything by default)
package http
default allow = true
# GOOD (secure - denies by default)
package http
default allow = false
allow { ... specific conditions ... }
Wrong Pipeline Order
# BAD (auth before rate limit allows DoS via auth endpoints)handlers:-name:oauth2type:middleware.http.oauth2-name:ratelimittype:middleware.http.ratelimit# GOOD (rate limit protects auth endpoints)handlers:-name:ratelimittype:middleware.http.ratelimit-name:oauth2type:middleware.http.oauth2
Integration Points
This skill integrates with:
middleware-expert agent for detailed configuration help
security-scanner skill for broader security analysis
/dapr:middleware command to generate valid configs
