envoyproxy/envoy

Question about validating two tokens in the headers and ignoring one header if not present.

Open

#34,308 opened on May 22, 2024

View on GitHub
 (1 comment) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/jwt_authnhelp wantedquestion

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

If you are reporting any crash or any potential security issue, do not open an issue in this repo. Please report the issue via emailing envoy-security@googlegroups.com where the issue will be triaged appropriately.

Title: validating two tokens in the headers and ignoring one header if not present.

Description: The requirement I have is to accept and additional token header named X-originating-api-authorization, validate it along with the default authorization header using same issuer but ignore the check if X-originating-api-authorization is not present.

I have tried to achieve this by using allow_missing: {} but it doesnt work.

Envoy config as follows: rules: - match: { prefix: "/" } requires: requires_all: requirements: - requires_any: requirements: - provider_name: xyz_auth_pageSize - allow_missing: {} - requires_any: requirements: - provider_name: xyz_auth0 - provider_name: xyz_abc_auth0

please help find a solution [optional Relevant Links:] https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/jwt_authn/v3/config.proto

Contributor guide

Research direction
Review the JWT filter documentation for per route allow missing. Ensure the allow missing is placed correctly in the route's requires block. Check that the optional header is not being processed by the provider without allow missing. Test with a minimal config to isolate.
Tech stack
None
Domain
backend
Issue type
Research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Envoy configurationJWT authentication
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60