Description
Currently, if "allow_degradation": false is set on forward-auth, the plugin will return 403 Forbidden in case of unavailability.
In some cases, this is not the right approach. Returning 403 in case of authz service failure is factually incorrect. The request is not forbidden, it's just the authz service failed to process the request.
Strictly correct approach would be returning e.g status code 503. Istio does exactly that, it is possible to configure the output code via statusOnError.
Description
Currently, if
"allow_degradation": falseis set onforward-auth, the plugin will return403 Forbiddenin case of unavailability.In some cases, this is not the right approach. Returning 403 in case of authz service failure is factually incorrect. The request is not forbidden, it's just the authz service failed to process the request.
Strictly correct approach would be returning e.g status code 503. Istio does exactly that, it is possible to configure the output code via
statusOnError.