fix(docs): avoid conflicting Istio auth headers - #132
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-Authored-By: Codex <codex@users.noreply.github.com>
e128e14 to
7f678ce
Compare
| includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "x-forwarded-host", "accept", "user-agent"] | ||
| includeAdditionalHeadersInCheck: | ||
| "x-forwarded-for": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" | ||
| "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" | ||
| "x-forwarded-proto": "%REQ(:SCHEME)%" |
There was a problem hiding this comment.
I would keep all headers except the x-forwarded-uri and x-forwarded-host. The real IP, the forwarded for and the original proto/method are good to have (the proto is required by the ext_authz module as well).
There was a problem hiding this comment.
"x-forwarded-for", "x-forwarded-proto" are still included in includeRequestHeadersInCheck, we don't necessarily need to copy the same in includeAdditionalHeadersInCheck as the connection manager by default sanitizes/determines these headers (unless we want to override the default value Envoy determines).
Will add x-real-ip in includeAdditionalHeadersInCheck, and accept back.
There was a problem hiding this comment.
Basically the headers we need are:
x-forwarded-for
x-real-ip
x-forwarded-proto
And we should be good to go. You are the envoy expert so :)
| includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "x-forwarded-host", "accept", "user-agent"] | ||
| includeAdditionalHeadersInCheck: | ||
| "x-forwarded-for": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" | ||
| "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" | ||
| "x-forwarded-proto": "%REQ(:SCHEME)%" | ||
| "x-forwarded-host": "%REQ(:AUTHORITY)%" | ||
| "x-forwarded-uri": "%REQ(:PATH)%" | ||
| "x-forwarded-method": "%REQ(:METHOD)%" |
2 participants
Updates the Istio/Kubernetes ext_authz examples to use the minimal required request headers and removes unnecessary additional-header overrides, aligning the documentation with tinyauth#1089.