ext_authz: respect keep_empty_value in HeaderValueOption by 404SkillNotFound · Pull Request #45103 · envoyproxy/envoy

404SkillNotFound · 2026-05-17T06:43:15Z

Commit Message: ext_authz: respect keep_empty_value in HeaderValueOption

Additional Description:
ext_authz was ignoring the keep_empty_value field in HeaderValueOption
and blindly adding all headers from auth responses, including empty-valued
ones. Added a check in copyHeaderFieldIntoResponse and copyOkResponseMutations
to skip empty-valued headers when keep_empty_value is false (default).

Risk Level: low
Testing: CI
Docs Changes: none
Release Notes: added changelog entry for ext_authz keep_empty_value fix

I used AI to help navigate the codebase for this change. I own the change.

Fixes #45003

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

repokitteh-read-only · 2026-05-17T06:43:20Z

Hi @404SkillNotFound, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #45103 was opened by 404SkillNotFound.

see: more, trace.

wbpcode

thanks for the contribution. This requires a test case to cover the new code.

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound · 2026-05-18T13:21:55Z

Added test cases covering both branches, when keep_empty_value is false (header dropped) and when it's true (header kept). Let me know if anything else is needed!

paul-r-gall · 2026-05-18T13:53:19Z

So even though this is a bugfix, it's also a behavior change, and needs to be protected by a runtime flag please.

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

repokitteh-read-only · 2026-05-18T15:31:42Z

CC @envoyproxy/runtime-guard-changes: FYI only for changes made to (source/common/runtime/runtime_features.cc).

🐱

Caused by: #45103 was synchronize by 404SkillNotFound.

see: more, trace.

404SkillNotFound · 2026-05-18T15:35:05Z

Done, guarded behind a runtime flag.

wbpcode

LGTM overall with only single comment.

wbpcode · 2026-05-19T07:30:31Z

+// TODO(404SkillNotFound): Flip to true to enforce keep_empty_value in ext_authz by default.
+FALSE_RUNTIME_GUARD(envoy_reloadable_features_ext_authz_respect_keep_empty_value);


The change is pretty safe and only affects the empty header value. I inclined you can use the normal runtime guard rather than the false runtime guard. Thanks.

Done, switched to RUNTIME_GUARD. Also added a changelog entry.

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

Signed-off-by: Shivang Upadhyay <shivang.upadhyay1@gmail.com>

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

…04SkillNotFound/envoy into fix/ext-authz-keep-empty-value Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

phlax · 2026-05-19T18:04:54Z

    HMAC secret validity.
-
+- area: ext_authz
+  change: |


needs to use new changelog layout - see #45095

/wait

…ntry layout Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

…on timeouts Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

ext_authz: respect keep_empty_value in HeaderValueOption

acf2f97

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound had a problem deploying to external-contributors May 17, 2026 06:43 — with GitHub Actions Error

wbpcode reviewed May 18, 2026

View reviewed changes

wbpcode assigned agrawroh May 18, 2026

test: update keep_empty_value test to assert correct behavior

9dfd7ad

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound had a problem deploying to external-contributors May 18, 2026 13:06 — with GitHub Actions Error

test: add positive case for keep_empty_value=true in ext_authz

5f84300

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound had a problem deploying to external-contributors May 18, 2026 13:15 — with GitHub Actions Error

ext_authz: guard keep_empty_value behind runtime flag

343e152

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound had a problem deploying to external-contributors May 18, 2026 15:31 — with GitHub Actions Error

wbpcode reviewed May 19, 2026

View reviewed changes

404SkillNotFound added 3 commits May 19, 2026 13:12

fix: move ext_authz_respect_keep_empty_value to RUNTIME_GUARD

d161585

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

changelog: add entry for ext_authz keep_empty_value fix

16d1eb7

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

changelog: add entry for ext_authz keep_empty_value fix

8bf78fc

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound had a problem deploying to external-contributors May 19, 2026 07:50 — with GitHub Actions Error

Merge branch 'main' into fix/ext-authz-keep-empty-value

6a7a54e

Signed-off-by: Shivang Upadhyay <shivang.upadhyay1@gmail.com>

404SkillNotFound temporarily deployed to external-contributors May 19, 2026 10:18 — with GitHub Actions Inactive

404SkillNotFound requested a review from wbpcode May 19, 2026 10:31

wbpcode previously approved these changes May 19, 2026

View reviewed changes

404SkillNotFound added 2 commits May 19, 2026 17:32

test: fix AuthzOkResponse matcher to check headers_to_set

c63c525

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

Merge branch 'fix/ext-authz-keep-empty-value' of https://github.com/4…

82b9a01

…04SkillNotFound/envoy into fix/ext-authz-keep-empty-value Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound dismissed wbpcode’s stale review via 82b9a01 May 19, 2026 12:06

404SkillNotFound had a problem deploying to external-contributors May 19, 2026 12:06 — with GitHub Actions Error

404SkillNotFound requested a review from wbpcode May 19, 2026 12:07

phlax reviewed May 19, 2026

View reviewed changes

repokitteh-read-only Bot added the waiting label May 19, 2026

404SkillNotFound added 2 commits May 20, 2026 11:49

changelog: migrate ext_authz keep_empty_value entry to new file-per-e…

162a5ed

…ntry layout Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

merge: resolve current.yaml conflict by taking upstream version

7f4086b

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

repokitteh-read-only Bot removed the waiting label May 20, 2026

404SkillNotFound temporarily deployed to external-contributors May 20, 2026 06:35 — with GitHub Actions Inactive

404SkillNotFound requested a review from phlax May 20, 2026 06:36

test: fix AuthzOkResponse matcher to check headers_to_set

04c0808

Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound temporarily deployed to external-contributors May 21, 2026 04:37 — with GitHub Actions Inactive

test: isolate strict header checks to grpc tests to prevent integrati…

44154bc

…on timeouts Signed-off-by: 404SkillNotFound <shivang.upadhyay1@gmail.com>

404SkillNotFound requested a deployment to external-contributors May 21, 2026 06:15 — with GitHub Actions Waiting

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ext_authz: respect keep_empty_value in HeaderValueOption#45103

ext_authz: respect keep_empty_value in HeaderValueOption#45103
404SkillNotFound wants to merge 14 commits into
envoyproxy:mainfrom
404SkillNotFound:fix/ext-authz-keep-empty-value

404SkillNotFound commented May 17, 2026 •

edited

Loading

Uh oh!

repokitteh-read-only Bot commented May 17, 2026

Uh oh!

wbpcode left a comment

Uh oh!

404SkillNotFound commented May 18, 2026

Uh oh!

paul-r-gall commented May 18, 2026

Uh oh!

repokitteh-read-only Bot commented May 18, 2026

Uh oh!

404SkillNotFound commented May 18, 2026

Uh oh!

wbpcode left a comment

Uh oh!

wbpcode May 19, 2026

Uh oh!

404SkillNotFound May 19, 2026

Uh oh!

phlax May 19, 2026

Uh oh!

404SkillNotFound May 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

		// TODO(404SkillNotFound): Flip to true to enforce keep_empty_value in ext_authz by default.
		FALSE_RUNTIME_GUARD(envoy_reloadable_features_ext_authz_respect_keep_empty_value);

Conversation

404SkillNotFound commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only Bot commented May 17, 2026

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

404SkillNotFound commented May 18, 2026

Uh oh!

paul-r-gall commented May 18, 2026

Uh oh!

repokitteh-read-only Bot commented May 18, 2026

Uh oh!

404SkillNotFound commented May 18, 2026

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode May 19, 2026

Choose a reason for hiding this comment

Uh oh!

404SkillNotFound May 19, 2026

Choose a reason for hiding this comment

Uh oh!

phlax May 19, 2026

Choose a reason for hiding this comment

Uh oh!

404SkillNotFound May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

404SkillNotFound commented May 17, 2026 •

edited

Loading

404SkillNotFound May 20, 2026 •

edited

Loading