Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: include custom headers in template only if requested #61

Merged
merged 1 commit into from
Feb 21, 2024

Conversation

natalian98
Copy link
Contributor

The recently added X-Name and X-Email headers cause issues in processing requests when the Extra.identity.traits claims are not returned upon authentication. Oathkeeper returns 500 response when it fails to parse the value of custom headers. This doesn't concern production auth-proxy use cases, but breaks a workaround used in traefik tests.

We use anonymous authentication handler in an access rule in this test as a workaround to check return headers without deploying identity platform. To make it work, oathkeeper should not attempt to parse headers that are not sent back by the anonymous handler. Note that eventually the IA proxy only returns headers specified in traefik forward-auth config, but oathkeeper tries to evaluate them anyways.

This PR fixes that by appending the extra headers only if explicitly requested by auth-proxy.

@natalian98 natalian98 marked this pull request as ready for review February 21, 2024 09:53
@natalian98 natalian98 requested a review from a team as a code owner February 21, 2024 09:53
@natalian98 natalian98 marked this pull request as draft February 21, 2024 10:14
@natalian98 natalian98 marked this pull request as ready for review February 21, 2024 10:15
@natalian98 natalian98 merged commit c9626b1 into main Feb 21, 2024
3 checks passed
@natalian98 natalian98 deleted the headers-template-fix branch February 21, 2024 10:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants