Stop sending API key with API requests

stephencdaly · stephencdaly · commit ae1dcc4e6e1c · 2025-09-24T16:58:24.000+01:00
forms-admin does not require an API key for requests as the /api/
endpoints are only accessible from within the VPC in our deployed
environments.

Stop sending the API key with requests and remove the configuration
setting as forms-runner now makes requests to forms-admin rather than
forms-api.
diff --git a/.review_apps/ecs_task_definition.tf b/.review_apps/ecs_task_definition.tf
@@ -22,7 +22,6 @@ locals {
     { name = "SETTINGS__ANALYTICS_ENABLED", value = "false" },
     { name = "SETTINGS__CLOUDWATCH_METRICS_ENABLED", value = "false" },
     { name = "SETTINGS__FORMS_ADMIN__BASE_URL", value = "https://${local.admin_app_hostname}" },
-    { name = "SETTINGS__FORMS_API__AUTH_KEY", value = "unsecured_api_key_for_review_apps_only" },
     { name = "SETTINGS__FORMS_API__BASE_URL", value = "http://localhost:9292" },
     { name = "SETTINGS__FORMS_ENV", value = "review" },
 
@@ -40,7 +39,6 @@ locals {
     { name = "RAILS_DEVELOPMENT_HOSTS", value = "localhost:9292" },
     { name = "RAILS_ENV", value = "production" },
     { name = "SECRET_KEY_BASE", value = "unsecured_secret_key_material" },
-    { name = "SETTINGS__FORMS_API__AUTH_KEY", value = "unsecured_api_key_for_review_apps_only" },
     { name = "SETTINGS__FORMS_ENV", value = "review" },
   ]
 
diff --git a/app/resources/api/v2/form_document_resource.rb b/app/resources/api/v2/form_document_resource.rb
@@ -3,7 +3,6 @@ class Api::V2::FormDocumentResource < ActiveResource::Base
   self.site = Settings.forms_api.base_url
   self.prefix = "/api/v2/"
   self.include_format_in_path = false
-  headers["X-API-Token"] = Settings.forms_api.auth_key
 
   class Step < ActiveResource::Base
     self.site = Settings.forms_api.base_url
diff --git a/config/settings.yml b/config/settings.yml
@@ -6,8 +6,6 @@ forms_admin:
   base_url: http://localhost:3000
 
 forms_api:
-  # Authentication key to authenticate forms-runner to forms-api
-  auth_key: development_key
   # URL to form-admin API endpoints
   base_url: http://localhost:3000
 
diff --git a/spec/config/settings_spec.rb b/spec/config/settings_spec.rb
@@ -29,7 +29,6 @@
   describe ".forms_api" do
     forms_api = settings[:forms_api]
 
-    include_examples expected_value_test, :auth_key, forms_api, "development_key"
     include_examples expected_value_test, :base_url, forms_api, "http://localhost:3000"
   end
 
diff --git a/spec/features/email_confirmation_spec.rb b/spec/features/email_confirmation_spec.rb
@@ -6,18 +6,8 @@
   let(:question_text) { Faker::Lorem.question }
   let(:text_answer) { Faker::Lorem.sentence }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/features/fill_in_and_submit_form_spec.rb b/spec/features/fill_in_and_submit_form_spec.rb
@@ -7,19 +7,8 @@
   let(:answer_text) { "Answer text" }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/features/fill_in_and_submit_form_with_csv_spec.rb b/spec/features/fill_in_and_submit_form_with_csv_spec.rb
@@ -9,12 +9,7 @@
   end
   let(:form) { build :v2_form_document, :live?, id: 1, name: "Fill in this form", steps:, start_page: steps.first.id, submission_type: "email_with_csv" }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/features/fill_in_autocomplete_question_spec.rb b/spec/features/fill_in_autocomplete_question_spec.rb
@@ -8,19 +8,8 @@
   let(:answer_text) { "Answer 1" }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/features/fill_in_file_upload_question_spec.rb b/spec/features/fill_in_file_upload_question_spec.rb
@@ -9,19 +9,8 @@
   let(:answer_text) { "Answer 1" }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   let(:test_file) { "tmp/a-file.txt" }
   let(:test_file_content) { "some content" }
diff --git a/spec/features/fill_in_form_with_exit_page_spec.rb b/spec/features/fill_in_form_with_exit_page_spec.rb
@@ -7,19 +7,8 @@
   let(:question_text) { Faker::Lorem.question }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/features/fill_in_single_repeatable_form_spec.rb b/spec/features/fill_in_single_repeatable_form_spec.rb
@@ -9,19 +9,8 @@
   let(:second_answer_text) { "7" }
   let(:reference) { Faker::Alphanumeric.alphanumeric(number: 8).upcase }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
-
-  let(:post_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Content-Type" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
+  let(:post_headers) { { "Content-Type" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/requests/errors_controller_spec.rb b/spec/requests/errors_controller_spec.rb
@@ -50,12 +50,7 @@
       )
     end
 
-    let(:req_headers) do
-      {
-        "X-API-Token" => Settings.forms_api.auth_key,
-        "Accept" => "application/json",
-      }
-    end
+    let(:req_headers) { { "Accept" => "application/json" } }
 
     before do
       ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/requests/forms/add_another_answer_controller_spec.rb b/spec/requests/forms/add_another_answer_controller_spec.rb
@@ -20,12 +20,7 @@
     build :v2_question_page_step, :with_text_settings, id: 2
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/draft" }
 
diff --git a/spec/requests/forms/base_controller_spec.rb b/spec/requests/forms/base_controller_spec.rb
@@ -41,12 +41,7 @@
     ]
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/live" }
 
diff --git a/spec/requests/forms/check_your_answers_controller_spec.rb b/spec/requests/forms/check_your_answers_controller_spec.rb
@@ -73,12 +73,7 @@
     ]
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/live" }
   let(:mode) { "form" }
diff --git a/spec/requests/forms/page_controller_spec.rb b/spec/requests/forms/page_controller_spec.rb
@@ -39,12 +39,7 @@
 
   let(:is_optional) { false }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/live" }
   let(:mode) { "form" }
diff --git a/spec/requests/forms/privacy_page_controller_spec.rb b/spec/requests/forms/privacy_page_controller_spec.rb
@@ -37,12 +37,7 @@
     ]
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   describe "#show" do
     before do
diff --git a/spec/requests/forms/remove_answer_controller_spec.rb b/spec/requests/forms/remove_answer_controller_spec.rb
@@ -22,12 +22,7 @@
     build :v2_question_page_step, :with_text_settings, id: 2
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/draft" }
 
diff --git a/spec/requests/forms/remove_file_controller_spec.rb b/spec/requests/forms/remove_file_controller_spec.rb
@@ -25,12 +25,7 @@
 
   let(:steps_data) { [file_upload_step, text_question_step] }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/live" }
   let(:mode) { "form" }
diff --git a/spec/requests/forms/review_file_controller_spec.rb b/spec/requests/forms/review_file_controller_spec.rb
@@ -25,12 +25,7 @@
 
   let(:steps_data) { [file_upload_step, text_question_step] }
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:api_url_suffix) { "/live" }
   let(:mode) { "form" }
diff --git a/spec/requests/forms/submitted_controller_spec.rb b/spec/requests/forms/submitted_controller_spec.rb
@@ -48,12 +48,7 @@
     }
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   describe "#submitted" do
     before do
diff --git a/spec/resources/api/v2/form_document_resource_spec.rb b/spec/resources/api/v2/form_document_resource_spec.rb
@@ -154,12 +154,7 @@
          "routing_conditions" => [] }] }
   end
 
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   before do
     ActiveResource::HttpMock.respond_to do |mock|
diff --git a/spec/services/api/v1/form_snapshot_repository_spec.rb b/spec/services/api/v1/form_snapshot_repository_spec.rb
@@ -1,12 +1,7 @@
 require "rails_helper"
 
 RSpec.describe Api::V1::FormSnapshotRepository do
-  let(:req_headers) do
-    {
-      "X-API-Token" => Settings.forms_api.auth_key,
-      "Accept" => "application/json",
-    }
-  end
+  let(:req_headers) { { "Accept" => "application/json" } }
 
   let(:form_id) { 1 }
   let(:api_v2_response_data) do
diff --git a/spec/services/form_submission_service_spec.rb b/spec/services/form_submission_service_spec.rb
@@ -130,12 +130,7 @@
         let(:aws_ses_submission_service_spy) { instance_double(AwsSesSubmissionService) }
         let(:mail_message_id) { "1234" }
 
-        let(:req_headers) do
-          {
-            "X-API-Token" => Settings.forms_api.auth_key,
-            "Accept" => "application/json",
-          }
-        end
+        let(:req_headers) { { "Accept" => "application/json" } }
 
         before do
           ActiveResource::HttpMock.respond_to do |mock|
