Make it possible for Go agents to use auth tokens from HTTP header#10237
Make it possible for Go agents to use auth tokens from HTTP header#10237mshaposhnik merged 8 commits intomasterfrom
Conversation
benoitf
added
the
status/code-review
agents/go-agents/core/auth/auth.go
Outdated
| token := req.URL.Query().Get("token") | ||
| if token == "" { | ||
| header := req.Header.Get("Authorization") | ||
| if header != "" && strings.HasPrefix(strings.ToLower(header), "bearer") { |
There was a problem hiding this comment.
it's impossible in our authentication implementation but still, you check bearer word and cut bearer what if there will be a token that starts with bearer that is not type but just part of token like bearer9SUcJXjsdenx. Maybe it would be better to check if token is prefixed with bearer
There was a problem hiding this comment.
Bearer word indicates type of token, there also can be Basic or Digest which is not supported. So we cut it away to have pure token. Or do i understood your question wrong ?
There was a problem hiding this comment.
Markdown helps me to confuse you =)
Let me rephrase, you check bearer word without space and cut bearer with space (7 characters) Maybe it would be better to check if token is prefixed with **bearer ** with space.
|
|
||
| public ExecServerLivenessProbeConfigFactory(int successThreshold) { | ||
| @Inject | ||
| public ExecServerLivenessProbeConfigFactory( |
There was a problem hiding this comment.
I think we are able not to change current approach with public available liveness probes.
@skabashnyuk WDYT? Should we revert it here and create an issue for implementing exclude in JWT proxy?
benoitf
removed
the
status/code-review
5 participants
What does this PR do?
For now Go agents is able to extract aithentication tokens only from request query parameters,
which is inconvenient for proxy authetication and has some other disadvantages.
This PR makes possible to pass tokens via
Authorizationheader and refactors readiness/liveness probes to use them.What issues does this PR fix or reference?
Release Notes
N/A
Docs PR
N/A