RabbitMQ-访问控制：仅允许排他/自动删除队列

Question

I am developing a typical SaaS product, where users can login and do something .

The frontends are JS for web and Android for smartphones. The frontends should get a notification when something has been updated, so they can refresh their views. I am thinking about using RabbitMQ for this purpose.

My propose is that each user has its own exchange. When something interesting happens for user, a message is sent to his exchange. Next, when the frontend logs in, it can create an exclusive/auto-delete, bound to his exchange. So, each frontend session has its own exclusive/auto-delete queue. Therefore, a notification will be retrieved by all active/online frontends, since each of them has their own private queue, which is the expected behavior.

Now to my question: how can I prevent that a frontend declares other kind of (possibly durable) queues? The frontend should only be allowed to create its own exclusive/auto-delete queue, nothing more. I read through the documentation ( https://www.rabbitmq.com/access-control.html ), but that does not seem to directly supported?

Answer 1

You can use the rabbitmq_auth_backend_http community plugin and then build your own custom web app which RabbitMQ will call to authorize each request. The web app is very simple, it only needs to implement three endpoints and can be written in any language you choose.

More information can be found here: https://github.com/rabbitmq/rabbitmq-auth-backend-http There's also a Django app in the examples folder that you can customize to support your unique requirements.

Also, you can use a single Topic exchange for all your users. Each user can have a unique queue bound to that topic exchange, so that all messages with the users key will be sent to their queue via the exchange. You can use your custom authorization API to make sure users only publish and subscribe to queues that they are authorized for, since the authorization web app is aware of the topic key a user is trying to publish a message to.