envoyproxy/envoy
oauth2: configurable safety margin to expire cookies before the contained tokens expire
Offen
#45.749 geöffnet am 22.06.2026
area/oauthenhancementhelp wanted
Repository-Metriken
- Stars
- (27.997 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 8T) (378 gemergte PRs in 30 T)
Beschreibung
Title: oauth2: configurable safety margin to expire cookies before the contained tokens expire
Description:
Add a configurable safety margin to the OAuth2 HTTP filter so that the browser cookies it sets expire slightly earlier than the tokens they carry. This is the mirror of the jwt_authn filter's clock_skew_seconds. It shortens cookie validity so a request never arrives at the upstream.
This will prevent errors when the request processing takes seconds or a minute, and the upstream service invokes other services on behalf of the browser user, using the JWT injected by the OAuth2 filter. Using clock_skew_seconds does not help because the initial request gets accepted by the OAuth2 filter
A proposal:
http_filters:
- name: envoy.filters.http.oauth2
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
config:
# ...
# Expire/treat the auth cookies as invalid this many seconds before the
# contained token actually expires. Forces re-auth/refresh proactively.
cookie_expiry_margin: 30s # name TBD