fix(openid-connect): use_jwks breaking authentication header#10670
Merged
moonming merged 2 commits intoJan 9, 2024
Merged
Conversation
jesse-r-s-hines
changed the title
juststillthinking
changed the title
Contributor
Contributor
Author
|
I'm still a bit confused on how the APISIX tests work, but I've added a test that should check for the bug in #10670. |
Contributor
Author
|
I can't replicate the linting failure by running |
Contributor
Author
|
I've tried that, |
|
|
||
|
|
||
| === TEST 33: Access route to validate "x-userinfo" in request header | ||
| === TEST 35: Access route to validate "x-userinfo" in request header |
Contributor
There was a problem hiding this comment.
I suggest put your newly added test cases to the end of the file, so that you won't need to modify the index of the rest test cases.
The index of test cases below this one are not correct
Contributor
Author
There was a problem hiding this comment.
Oh of course, I'm not sure how I missed that. I've updated the test file.
juststillthinking
added
wait for update
If you use jwks instead of explicitly setting the public key, requests with a proper `Authorization: Bearer` header would still get the `302 Found` response. Fix by adding `conf.use_jwks` to the check.
Contributor
Author
|
I believe the linting should pass now. |
kayx23
removed
the
wait for update
juststillthinking
approved these changes
Jan 4, 2024
moonming
approved these changes
Jan 9, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
When using the openid-connect plugin with
bearer_onlyas false, the plugin will normally authenticate both requests with the session cookie and requests with an explicitAuthorization: Bearerheader. This is very useful to allow both browser based and programmatic access to some resource.However, if you set
use_jwksinstead of explicitly setting the public key, requests with a properAuthorization: Bearerheader still get the302 Foundresponse.Fix by adding
conf.use_jwksto the check.Fixes #10669