fix: include custom headers in template only if requested #61
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The recently added
X-Name
andX-Email
headers cause issues in processing requests when theExtra.identity.traits
claims are not returned upon authentication. Oathkeeper returns 500 response when it fails to parse the value of custom headers. This doesn't concern productionauth-proxy
use cases, but breaks a workaround used in traefik tests.We use
anonymous
authentication handler in an access rule in this test as a workaround to check return headers without deploying identity platform. To make it work, oathkeeper should not attempt to parse headers that are not sent back by the anonymous handler. Note that eventually the IA proxy only returns headers specified in traefik forward-auth config, but oathkeeper tries to evaluate them anyways.This PR fixes that by appending the extra headers only if explicitly requested by
auth-proxy
.