envoyproxy/envoy

Running Lua filter as fail closed

Open

#14,980 opened on Feb 8, 2021

View on GitHub
 (9 comments) (3 reactions) (0 assignees)C++ (5,373 forks)batch import
area/luahelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Is there a way to run Lua filters as "fail closed"? I have observed that the requested resources are served normally if an error/exception occurs in the Lua script. I would rather see 503 (at least for some scripts, s.a. a Lua auth filter). Can this be done/configured, or do I need to be super defensive (paranoid) when writing the filter?

Contributor guide

Research direction
Investigate the Envoy Lua filter source code to understand how errors are currently handled and propose a configuration option to make the filter fail closed by returning a 503 on Lua script errors.
Tech stack
lua
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
LuaEnvoy configuration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40