feat: ignore other auth prefixes

.changesets/feat_lleadbet_ignore_other_auth_prefixes.md

@@ -0,0 +1,20 @@
+### Ability to ignore other auth prefixes in the JWT plugin
+
+You can now ignore whether to ignore other header prefixes with the JWT plugin. As many applications will use the format of `Authorization: <scheme> <token>`, this will enable the use other schemes within the `Authorization` header. 
+
+If the header prefix is an empty string, this option will be ignored. 
+
+You can configure this, such as:
+
+```yaml title="router.yaml"
+authentication:
+  router:
+    jwt:
+      header_name: authorization
+      header_value_prefix: "Bearer"
+      ignore_mismatched_prefix: true
+```
+
+In the above, the router will ignore `Authorization: Basic <token>`, but process requests with `Authorization: Bearer <token>` defined.
+
+By [@lleadbet](https://github.com/lleadbet) in https://github.com/apollographql/router/pull/4718

apollo-router/src/plugins/authentication/mod.rs

@@ -128,6 +128,9 @@ struct JWTConf {
     /// Header value prefix
     #[serde(default = "default_header_value_prefix")]
     header_value_prefix: String,
+    /// Whether to ignore any mismatched prefixes
+    #[serde(default = "default_ignore_other_prefixes")]
+    ignore_other_prefixes: bool,
 }
 
 #[derive(Clone, Debug, Deserialize, JsonSchema)]
@@ -181,6 +184,10 @@ fn default_poll_interval() -> Duration {
     DEFAULT_AUTHENTICATION_DOWNLOAD_INTERVAL
 }
 
+fn default_ignore_other_prefixes() -> bool {
+    false
+}
+
 #[derive(Debug, Default)]
 struct JWTCriteria {
     alg: Algorithm,
@@ -532,11 +539,13 @@ fn authenticate(
 
     // Make sure the format of our message matches our expectations
     // Technically, the spec is case sensitive, but let's accept
-    // case variations
-    //
+    // case variations. Furthermore, if the user has configured to ignore
+    // mismatched prefixes, we'll skip this check and instead do it in a
+    // later step.
     let prefix_len = config.header_value_prefix.len();
-    if jwt_value.len() < prefix_len
-        || !&jwt_value[..prefix_len].eq_ignore_ascii_case(&config.header_value_prefix)
+    if !&config.ignore_other_prefixes
+        && (jwt_value.len() < prefix_len
+            || !&jwt_value[..prefix_len].eq_ignore_ascii_case(&config.header_value_prefix))
     {
         return failure_message(
             request.context,
@@ -545,6 +554,15 @@ fn authenticate(
         );
     }
 
+    // Here we'll check if the user has configured to ignore mismatched prefixes
+    // and if so, we'll skip any unknown prefixes and not validate the token.
+    if config.ignore_other_prefixes
+        && (jwt_value.len() < prefix_len
+            || !&jwt_value[..prefix_len].eq_ignore_ascii_case(&config.header_value_prefix))
+    {
+        return ControlFlow::Continue(request);
+    }
+
     // If there's no header prefix, we need to avoid splitting the header
     let jwt = if config.header_value_prefix.is_empty() {
         // check for whitespace- we've already trimmed, so this means the request has a prefix that shouldn't exist

apollo-router/src/plugins/authentication/tests.rs

@@ -36,13 +36,14 @@ fn create_an_url(filename: &str) -> String {
 }
 
 async fn build_a_default_test_harness() -> router::BoxCloneService {
-    build_a_test_harness(None, None, false).await
+    build_a_test_harness(None, None, true, None).await
 }
 
 async fn build_a_test_harness(
     header_name: Option<String>,
     header_value_prefix: Option<String>,
     multiple_jwks: bool,
+    ignore_other_prefixes: Option<bool>,
 ) -> router::BoxCloneService {
     // create a mock service we will use to test our plugin
     let mut mock_service = test::MockSupergraphService::new();
@@ -110,6 +111,11 @@ async fn build_a_test_harness(
             serde_json::Value::String(hp);
     }
 
+    if let Some(ignore_other_prefixes) = ignore_other_prefixes {
+        config["authentication"]["router"]["jwt"]["ignore_other_prefixes"] =
+            serde_json::Value::Bool(ignore_other_prefixes);
+    }
+
     crate::TestHarness::builder()
         .configuration_json(config)
         .unwrap()
@@ -424,9 +430,44 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt() {
     assert_eq!(expected_mock_response_data, response.data.as_ref().unwrap());
 }
 
+#[tokio::test]
+async fn it_accepts_when_auth_prefix_does_not_match_config_and_is_ignored() {
+    let test_harness = build_a_test_harness(None, None, true, Some(true)).await;
+    // Let's create a request with our operation name
+    let request_with_appropriate_name = supergraph::Request::canned_builder()
+        .operation_name("me".to_string())
+        .header(http::header::AUTHORIZATION, "Basic dXNlcjpwYXNzd29yZA==")
+        .build()
+        .unwrap();
+
+    // ...And call our service stack with it
+    let mut service_response = test_harness
+        .oneshot(request_with_appropriate_name.try_into().unwrap())
+        .await
+        .unwrap();
+    let response: graphql::Response = serde_json::from_slice(
+        service_response
+            .next_response()
+            .await
+            .unwrap()
+            .unwrap()
+            .to_vec()
+            .as_slice(),
+    )
+    .unwrap();
+
+    assert_eq!(response.errors, vec![]);
+
+    assert_eq!(StatusCode::OK, service_response.response.status());
+
+    let expected_mock_response_data = "response created within the mock";
+    // with the expected message
+    assert_eq!(expected_mock_response_data, response.data.as_ref().unwrap());
+}
+
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_multiple_jwks_and_valid_jwt() {
-    let test_harness = build_a_test_harness(None, None, true).await;
+    let test_harness = build_a_test_harness(None, None, true, None).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -465,7 +506,7 @@ async fn it_accepts_when_auth_prefix_has_correct_format_multiple_jwks_and_valid_
 
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_auth() {
-    let test_harness = build_a_test_harness(Some("SOMETHING".to_string()), None, false).await;
+    let test_harness = build_a_test_harness(None, None, true, None).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -504,7 +545,7 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_aut
 
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_prefix() {
-    let test_harness = build_a_test_harness(None, Some("SOMETHING".to_string()), false).await;
+    let test_harness = build_a_test_harness(None, None, true, None).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -543,7 +584,7 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_pre
 
 #[tokio::test]
 async fn it_accepts_when_no_auth_prefix_and_valid_jwt_custom_prefix() {
-    let test_harness = build_a_test_harness(None, Some("".to_string()), false).await;
+    let test_harness = build_a_test_harness(None, None, true, None).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -583,13 +624,14 @@ async fn it_accepts_when_no_auth_prefix_and_valid_jwt_custom_prefix() {
 #[tokio::test]
 #[should_panic]
 async fn it_panics_when_auth_prefix_has_correct_format_but_contains_whitespace() {
-    let _test_harness = build_a_test_harness(None, Some("SOMET HING".to_string()), false).await;
+    let _test_harness =
+        build_a_test_harness(None, Some("SOMET HING".to_string()), false, None).await;
 }
 
 #[tokio::test]
 #[should_panic]
 async fn it_panics_when_auth_prefix_has_correct_format_but_contains_trailing_whitespace() {
-    let _test_harness = build_a_test_harness(None, Some("SOMETHING ".to_string()), false).await;
+    let _test_harness = build_a_test_harness(None, None, true, None).await;
 }
 
 async fn build_jwks_search_components() -> JwksManager {

docs/source/configuration/authn-jwt.mdx

@@ -133,6 +133,23 @@ The default value is `Bearer`.
 </td>
 </tr>
 
+<tr>
+<td style="min-width: 150px;">
+
+##### `ignore_other_prefixes`
+
+</td>
+<td>
+
+Whether to ignore other prefixes in the `Authorization` header. If set to `false`, the router will only accept tokens with the prefix specified in `header_value_prefix`. If set to `true`, the router will ignore any requests that don't start with the prefix specified in `header_value_prefix`.
+
+If a header prefix is set to an empty string, this option is ignored.
+
+The default value is `false`.
+
+</td>
+</tr>
+
 </tbody>
 </table>