docs(forward-auth): clarify that X-Forwarded-* carry the client request - #13978
Open
shreemaan-abhishek wants to merge 1 commit into
Open
shreemaan-abhishek wants to merge 1 commit into
shreemaan-abhishek wants to merge 1 commit into
Conversation
The X-Forwarded-* headers forward-auth sends describe the request as the client sent it. When proxy-rewrite is enabled on the same route, the upstream receives a rewritten scheme, method, host and URI while these headers keep the client values, which is easy to miss when writing an authorization policy. Spell that out and document forwarding $upstream_uri via extra_headers for policies keyed on the URI the upstream actually receives.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
X-Forwarded-*headers thatforward-authsends to the authorization service describe the request as the client sent it: the client's scheme, method, host, URI and source IP.When
proxy-rewriteis configured on the same route, the upstream receives the rewritten scheme, method, host and URI, while these headers keep carrying the client values. The docs listed the headers as bare names (X-Forwarded-Uri: URI), which makes that easy to miss when writing an authorization policy against upstream paths.This clarifies the behaviour in both the English and Chinese docs, and documents how to forward the URI the upstream actually receives using
extra_headerswith$upstream_uri.Docs only, no behaviour change.
Which issue(s) this PR fixes:
N/A
Checklist