I’m installing SonarQube with HTTP header authentication behind a load balancer. The load balancer will manage the user sessions and generate the required auth headers for SonarQube.
However, this flow should not be executed on requests from the scanner.
How can the requests from the scanner be identified?
Looking at access.log, I can see scanner requests having paths beginning with /api, /static and /batch. Is this the full list of path prefixes in requests from the scanner? Are these paths requested only by the scanner?
I have identified that some requests have the Authorization header, but not all of them. I have also identified that some requests have a UserAgent header value prefixed with Scanner, but, again, not all of them.
As an alternative, I could have a different host configured for the scanner, without the load balancer flow acting on it, but I would prefer that as a second option.
No. In particular, the entire user experience in the browser is driven by /api calls, and static will serve images, the build wrapper, etc.
I think most users with this requirement filter on a User Agent like you’ve mentioned. What are the cases you’ve found where requests from the scanner aren’t using a consistent user agent?