feat: ignore other auth prefixes

.changesets/feat_lleadbet_ignore_other_auth_prefixes.md

@@ -0,0 +1,20 @@
+### Ability to ignore other auth prefixes in the JWT plugin
+
+You can now choose whether to ignore other header prefixes with the JWT plugin. Many applications will use the format of `Authorization: <scheme> <token>` and this will enable the use of other schemes within the `Authorization` header. 
+
+If the header prefix is an empty string, this option will be ignored. 
+
+You can configure this, such as:
+
+```yaml title="router.yaml"
+authentication:
+  router:
+    jwt:
+      header_name: authorization
+      header_value_prefix: "Bearer"
+      ignore_mismatched_prefix: true
+```
+
+In the above, the router will ignore `Authorization: Basic <token>`, but process requests with `Authorization: Bearer <token>` defined.
+
+By [@lleadbet](https://github.com/lleadbet) in https://github.com/apollographql/router/pull/4718

apollo-router/src/configuration/snapshots/apollo_router__configuration__tests__schema_generation.snap

@@ -251,6 +251,11 @@ expression: "&schema"
                   "default": "Bearer",
                   "type": "string"
                 },
+                "ignore_other_prefixes": {
+                  "description": "Whether to ignore any mismatched prefixes",
+                  "default": false,
+                  "type": "boolean"
+                },
                 "jwks": {
                   "description": "List of JWKS used to verify tokens",
                   "type": "array",

apollo-router/src/plugins/authentication/mod.rs

@@ -133,7 +133,9 @@ struct JWTConf {
     /// Header value prefix
     #[serde(default = "default_header_value_prefix")]
     header_value_prefix: String,
-
+    /// Whether to ignore any mismatched prefixes
+    #[serde(default)]
+    ignore_other_prefixes: bool,
     /// Alternative sources to extract the JWT
     #[serde(default)]
     sources: Vec<Source>,
@@ -571,7 +573,7 @@ fn authenticate(
 
     let mut jwt = None;
     for source in &config.sources {
-        match extract_jwt(source, request.router_request.headers()) {
+        match extract_jwt(source, config.ignore_other_prefixes, request.router_request.headers()) {
             None => continue,
             Some(Err(error)) => {
                 return failure_message(request.context, error, StatusCode::BAD_REQUEST)
@@ -676,6 +678,7 @@ fn authenticate(
 
 fn extract_jwt<'a, 'b: 'a>(
     source: &'a Source,
+    ignore_other_prefixes: bool,
     headers: &'b HeaderMap,
 ) -> Option<Result<&'b str, AuthenticationError<'a>>> {
     match source {
@@ -706,10 +709,14 @@ fn extract_jwt<'a, 'b: 'a>(
             if jwt_value.len() < prefix_len
                 || !&jwt_value[..prefix_len].eq_ignore_ascii_case(value_prefix)
             {
-                return Some(Err(AuthenticationError::InvalidPrefix(
-                    jwt_value_untrimmed,
-                    value_prefix,
-                )));
+                if ignore_other_prefixes {
+                    return None;
+                } else {
+                    return Some(Err(AuthenticationError::InvalidPrefix(
+                        jwt_value_untrimmed,
+                        value_prefix,
+                    )));
+                }
             }
             // If there's no header prefix, we need to avoid splitting the header
             let jwt = if value_prefix.is_empty() {

apollo-router/src/plugins/authentication/tests.rs

@@ -47,13 +47,14 @@ fn create_an_url(filename: &str) -> String {
 }
 
 async fn build_a_default_test_harness() -> router::BoxCloneService {
-    build_a_test_harness(None, None, false).await
+    build_a_test_harness(None, None, false, false).await
 }
 
 async fn build_a_test_harness(
     header_name: Option<String>,
     header_value_prefix: Option<String>,
     multiple_jwks: bool,
+    ignore_other_prefixes: bool,
 ) -> router::BoxCloneService {
     // create a mock service we will use to test our plugin
     let mut mock_service = test::MockSupergraphService::new();
@@ -121,6 +122,9 @@ async fn build_a_test_harness(
             serde_json::Value::String(hp);
     }
 
+    config["authentication"]["router"]["jwt"]["ignore_other_prefixes"] =
+        serde_json::Value::Bool(ignore_other_prefixes);
+
     crate::TestHarness::builder()
         .configuration_json(config)
         .unwrap()
@@ -435,9 +439,44 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt() {
     assert_eq!(expected_mock_response_data, response.data.as_ref().unwrap());
 }
 
+#[tokio::test]
+async fn it_accepts_when_auth_prefix_does_not_match_config_and_is_ignored() {
+    let test_harness = build_a_test_harness(None, None, false, true).await;
+    // Let's create a request with our operation name
+    let request_with_appropriate_name = supergraph::Request::canned_builder()
+        .operation_name("me".to_string())
+        .header(http::header::AUTHORIZATION, "Basic dXNlcjpwYXNzd29yZA==")
+        .build()
+        .unwrap();
+
+    // ...And call our service stack with it
+    let mut service_response = test_harness
+        .oneshot(request_with_appropriate_name.try_into().unwrap())
+        .await
+        .unwrap();
+    let response: graphql::Response = serde_json::from_slice(
+        service_response
+            .next_response()
+            .await
+            .unwrap()
+            .unwrap()
+            .to_vec()
+            .as_slice(),
+    )
+    .unwrap();
+
+    assert_eq!(response.errors, vec![]);
+
+    assert_eq!(StatusCode::OK, service_response.response.status());
+
+    let expected_mock_response_data = "response created within the mock";
+    // with the expected message
+    assert_eq!(expected_mock_response_data, response.data.as_ref().unwrap());
+}
+
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_multiple_jwks_and_valid_jwt() {
-    let test_harness = build_a_test_harness(None, None, true).await;
+    let test_harness = build_a_test_harness(None, None, true, false).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -476,7 +515,8 @@ async fn it_accepts_when_auth_prefix_has_correct_format_multiple_jwks_and_valid_
 
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_auth() {
-    let test_harness = build_a_test_harness(Some("SOMETHING".to_string()), None, false).await;
+    let test_harness =
+        build_a_test_harness(Some("SOMETHING".to_string()), None, false, false).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -515,7 +555,8 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_aut
 
 #[tokio::test]
 async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_prefix() {
-    let test_harness = build_a_test_harness(None, Some("SOMETHING".to_string()), false).await;
+    let test_harness =
+        build_a_test_harness(None, Some("SOMETHING".to_string()), false, false).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -554,7 +595,7 @@ async fn it_accepts_when_auth_prefix_has_correct_format_and_valid_jwt_custom_pre
 
 #[tokio::test]
 async fn it_accepts_when_no_auth_prefix_and_valid_jwt_custom_prefix() {
-    let test_harness = build_a_test_harness(None, Some("".to_string()), false).await;
+    let test_harness = build_a_test_harness(None, Some("".to_string()), false, false).await;
 
     // Let's create a request with our operation name
     let request_with_appropriate_name = supergraph::Request::canned_builder()
@@ -594,13 +635,15 @@ async fn it_accepts_when_no_auth_prefix_and_valid_jwt_custom_prefix() {
 #[tokio::test]
 #[should_panic]
 async fn it_panics_when_auth_prefix_has_correct_format_but_contains_whitespace() {
-    let _test_harness = build_a_test_harness(None, Some("SOMET HING".to_string()), false).await;
+    let _test_harness =
+        build_a_test_harness(None, Some("SOMET HING".to_string()), false, false).await;
 }
 
 #[tokio::test]
 #[should_panic]
 async fn it_panics_when_auth_prefix_has_correct_format_but_contains_trailing_whitespace() {
-    let _test_harness = build_a_test_harness(None, Some("SOMETHING ".to_string()), false).await;
+    let _test_harness =
+        build_a_test_harness(None, Some("SOMETHING ".to_string()), false, false).await;
 }
 
 #[tokio::test]

docs/source/configuration/authn-jwt.mdx

@@ -171,6 +171,23 @@ This is an array of possible token sources, as it could be provided in different
 </td>
 </tr>
 
+<tr>
+<td style="min-width: 150px;">
+
+##### `ignore_other_prefixes`
+
+</td>
+<td>
+
+Whether to ignore other prefixes in the `Authorization` header. If set to `false`, or unspecified, the router will only accept tokens with the prefix specified in `header_value_prefix`. If set to `true`, the router will ignore any requests that don't start with the prefix specified in `header_value_prefix`.
+
+If a header prefix is set to an empty string, this option is ignored.
+
+The default value is `false`.
+
+</td>
+</tr>
+
 </tbody>
 </table>