[TT-17442] Upstream WebSocket connection reuse ignores per-request auth headers#8303
Conversation
🎯 Recommended Merge TargetsBased on JIRA ticket TT-17442: Upstream WebSocket connection reuse ignores per-request auth headers Fix Version: Tyk 5.8.15Required:
Fix Version: Tyk 5.13.1Required:
Fix Version: Tyk 5.14.0
Required:
📋 Workflow
|
|
This PR addresses a bug where reused upstream WebSocket connections for GraphQL subscriptions ignored per-request authentication headers. The fix is implemented by updating the Files Changed AnalysisThe changes are limited to dependency management files:
This indicates that the functional fix is entirely contained within the updated dependency, and this PR serves to integrate that fix into the main gateway. Architecture & Impact Assessment
graph TD
subgraph Before_Fix ["Behavior Before Fix"]
Client1[Client 1 w/ Auth Header A] --> GQLProxy(GraphQL Proxy);
Client2[Client 2 w/ Auth Header B] --> GQLProxy;
GQLProxy --|1. Establishes WebSocket, sends Auth A|--> Upstream{Upstream GraphQL Service};
GQLProxy --|2. Reuses WebSocket, sends Auth A again (Incorrect)|--> Upstream;
end
subgraph After_Fix ["Behavior After Fix"]
Client1_fix[Client 1 w/ Auth Header A] --> GQLProxy_fix(GraphQL Proxy);
Client2_fix[Client 2 w/ Auth Header B] --> GQLProxy_fix;
GQLProxy_fix --|1. Establishes WebSocket, sends Auth A|--> Upstream_fix{Upstream GraphQL Service};
GQLProxy_fix --|2. Reuses WebSocket, sends Auth B (Correct)|--> Upstream_fix;
end
style GQLProxy fill:#f9f,stroke:#333,stroke-width:2px
style GQLProxy_fix fill:#9f9,stroke:#333,stroke-width:2px
Scope Discovery & Context ExpansionWhile the code change in this repository is minimal, the functional impact is significant for the security and correctness of GraphQL subscriptions. The issue is rooted in how the underlying The fix, contained within the dependency, likely targets the WebSocket transport layer to ensure that an appropriate hook properly injects the latest request's headers into the outgoing message to the upstream service, even when the underlying connection is reused. Metadata
Powered by Visor from Probelabs Last updated: 2026-06-11T05:21:07.135Z | Triggered by: pr_updated | Commit: 15724dd 💡 TIP: You can chat with Visor using |
✅ Security Check PassedNo security issues found – changes LGTM. ✅ Architecture Check PassedNo architecture issues found – changes LGTM. ✅ Performance Check PassedNo performance issues found – changes LGTM. Quality Issues (1)
Powered by Visor from Probelabs Last updated: 2026-06-11T05:20:50.564Z | Triggered by: pr_updated | Commit: 15724dd 💡 TIP: You can chat with Visor using |
kofoworola
added
the
deps-reviewed
…use-ignores-per-request-auth-headers
…use-ignores-per-request-auth-headers
🚨 Jira Linter FailedCommit: The Jira linter failed to validate your PR. Please check the error details below: 🔍 Click to view error detailsNext Steps
This comment will be automatically deleted once the linter passes. |
|
|
/release to release-5.8 |
|
/release to release-5.13 |
|
|
|
✅ Cherry-pick successful. A PR was created: #8309 |
…se ignores per-request auth headers (#8303) (#8309) [TT-17442] Upstream WebSocket connection reuse ignores per-request auth headers (#8303) <!-- Provide a general summary of your changes in the Title above --> ## Description <!-- Describe your changes in detail --> ## Related Issue <!-- This project only accepts pull requests related to open issues. --> <!-- If suggesting a new feature or change, please discuss it in an issue first. --> <!-- If fixing a bug, there should be an issue describing it with steps to reproduce. --> <!-- OSS: Please link to the issue here. Tyk: please create/link the JIRA ticket. --> ## Motivation and Context <!-- Why is this change required? What problem does it solve? --> ## How This Has Been Tested <!-- Please describe in detail how you tested your changes --> <!-- Include details of your testing environment, and the tests --> <!-- you ran to see how your change affects other areas of the code, etc. --> <!-- This information is helpful for reviewers and QA. --> ## Screenshots (if appropriate) ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Refactoring or add test (improvements in base code or adds test coverage to functionality) ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply --> <!-- If there are no documentation updates required, mark the item as checked. --> <!-- Raise up any additional concerns not covered by the checklist. --> - [ ] I ensured that the documentation is up to date - [ ] I explained why this PR updates go.mod in detail with reasoning why it's required - [ ] I would like a code coverage CI quality gate exception and have explained why Co-authored-by: Radosław Krawczyk <[email protected]> [TT-17442]: https://tyktech.atlassian.net/browse/TT-17442?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ Co-authored-by: Maciej Miś <[email protected]> Co-authored-by: Radosław Krawczyk <[email protected]>
…e ignores per-request auth headers (#8303) (#8308) Cherry-pick of `d0d255dcf75c4549e2d5149c60ef90ca381bbe12` from `master` to `release-5.8` requires manual resolution. **Conflicts detected:** 3 - go.sum Tips: - Check out this branch locally and run: `git cherry-pick -x d0d255d` - Resolve conflicts (including submodules if any), then push back to this branch. Original commit: d0d255d --------- Co-authored-by: Tyk Bot <[email protected]> Co-authored-by: Maciej Miś <[email protected]>
4 participants
Description
Related Issue
Motivation and Context
How This Has Been Tested
Screenshots (if appropriate)
Types of changes
Checklist