Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(proxy) keep proxy-authentication request header and proxy-authenticate response header #7724

Merged
merged 1 commit into from
Aug 18, 2021

Conversation

bungle
Copy link
Member

@bungle bungle commented Aug 17, 2021

Summary

It was reported by @ly123-liu on #7722 that Kong removes Proxy-Authentication header from upstream
request.

RFC2612 (https://datatracker.ietf.org/doc/html/rfc2616#section-13.5.1) specifies them as a hop-by-hop
headers that should be removed. But it did not consider use case of having multiple proxies, so RFC7235
corrected the wording https://datatracker.ietf.org/doc/html/rfc7235#section-4.4.

A proxy MAY relay the credentials from the client request to the next proxy if that is
the mechanism by which the proxies cooperatively authenticate a given request.

Issues Resolved

Fix #7722

…icate response header

### Summary

It was reported by @ly123-liu on #7722 that Kong removes `Proxy-Authentication` header from upstream
request.

RFC2612 (https://datatracker.ietf.org/doc/html/rfc2616#section-13.5.1) specifies them as a hop-by-hop
headers that should be removed. But it did not consider use case of having multiple proxies, so RFC7235
corrected the wording https://datatracker.ietf.org/doc/html/rfc7235#section-4.4.

> A proxy MAY relay the credentials from the client request to the next proxy if that is
> the mechanism by which the proxies cooperatively authenticate a given request.

### Issues Resolved

Fix #7722
@fffonion
Copy link
Contributor

Not a blokcer to this PR just a thought:
If I understand the RFC correctly, we are okay to relay it to next proxy/upstream as long as Kong doesn't consume the
proxy-authentication header. But if a proxy does consumes it, it will then the plugin's responsibility to
clear out the header. This indicates we might want a PDK function to properly follow the RFC, something
like header_value = kong.request.consume_hop_by_hop_header("proxy-authentication") and PDK clears
the head before it returns.

@bungle bungle merged commit 6e69413 into master Aug 18, 2021
@bungle bungle deleted the fix/7722 branch August 18, 2021 13:51
javierguerragiraldez pushed a commit that referenced this pull request Sep 2, 2021
…icate response header (#7724)

### Summary

It was reported by @ly123-liu on #7722 that Kong removes `Proxy-Authentication` header from upstream
request.

RFC2612 (https://datatracker.ietf.org/doc/html/rfc2616#section-13.5.1) specifies them as a hop-by-hop
headers that should be removed. But it did not consider use case of having multiple proxies, so RFC7235
corrected the wording https://datatracker.ietf.org/doc/html/rfc7235#section-4.4.

> A proxy MAY relay the credentials from the client request to the next proxy if that is
> the mechanism by which the proxies cooperatively authenticate a given request.

### Issues Resolved

Fix #7722

(cherry picked from commit 6e69413)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

kong client send a request with custom header, but upstream lost header, why ?
2 participants