OIDC pass-through matcher incorrectly treats the Bearer scheme as case-sensitive
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 84/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- go
- Domain
- authentication
Research direction
Start in internal/xds/translator/oidc.go around the default JWT extraction path referenced at lines 346 and 359. Reproduce the behavior with passThroughAuthHeader enabled using both bearer and Bearer schemes, then add regression coverage for capitalization and invalid JWT rejection. Done means both valid spellings receive identical treatment while JWT validation remains enforced.
Written by the indexing model from the issue text.
Description
Description:
With OIDC, JWT authentication, and passThroughAuthHeader enabled, the default JWT extraction path generates a pass-through matcher for Bearer without IgnoreCase: true.
The affected code is present in v1.8.4, line 346 and v1.9.1, line 359.
Repro steps:
- Configure OIDC and JWT with passThroughAuthHeader enabled and default JWT extraction.
- Send Authorization: bearer without OAuth cookies.
- Compare with Authorization: Bearer .
Actual:
Lowercase bearer does not match the pass-through rule and enters the OAuth2 flow. If a matching denyRedirect rule prevents login redirects, the gateway returns 401.
Expected: Both spellings should receive identical treatment:
- RFC 9110 §11.1 defines authentication scheme names as case-insensitive.
- RFC 6750 §2.1 defines Bearer credentials as credentials = "Bearer" 1*SP b64token. The "Bearer" ABNF literal is case-insensitive under RFC 5234 §2.3.
Suggested fix
Set IgnoreCase: true on the default Bearer prefix matcher. Preserve token contents and JWT validation, with regression tests covering scheme capitalization and rejection of invalid JWTs.
- Dominant language
- Go
- Stars
- 3.1k
- Forks
- 940
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 177
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from envoyproxy/gateway
-
/shutdown/ready can fail to return an HTTP response when readiness takes longer than the server write timeoutPossibly taken @floriankoch claimed this today. Opentriage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
envoyproxy/gateway#10562 ·
Maintainers usually reply within 1 day
-
provider runner swallows the manager error, leaving the controller alive without a health endpoint after losing the leaseMay be free again A pull request for this issue was closed without being merged. Opentriage
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
envoyproxy/gateway#10064 · 1 comment ·
Maintainers usually reply within 1 day
-
HTTP route rule processing does not check for DirectResponse or Redirect when filter processing has an errorPossibly taken @vshalpnjabi claimed this 9 days ago. Openhelp wanted kind/bug triage
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
envoyproxy/gateway#9454 ·
Maintainers usually reply within 1 day
-
is isHTTPRouteFilterReferencingSecret too eager ?May be free again A pull request for this issue was closed without being merged. Openstale triage
Difficulty 1/5 1-3 hours Newbie friendliness 72/100
envoyproxy/gateway#9339 · 1 comment ·
Maintainers usually reply within 1 day
-
stale triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
envoyproxy/gateway#8996 · 2 comments ·
Maintainers usually reply within 1 day
All issues in envoyproxy/gateway
Similar issues
-
book-layout.spec fails when the similar-books rail holds other projects' booksPossibly taken @praetorianer777 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
praetorianer777/GoTome#373 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
-
Adding an LDAP group reports every search failure as "LDAP Group DN is not found"Possibly taken @Daksha1611 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100