-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support header and cookie mutators in Istio based JWT handler #237
Comments
ValidationValidations that we need to discuss:
Cookie handlingIn the PoC the cookies are defined as Support in other handlers
|
Handling of existing headers and cookiesOry overwrites headers and cookie. The default behaviour of Istio HeaderSending request to path with header mutator for
The request will have the following header set Istio Add Istio Set CookieSending request to path with cookie mutator for
The request will have the following header set Istio Add Istio Set Istio custom handling for cookieWe could have a custom handling for Cookie header that will result in this: VirtualService config
This will result in the cookie header to have duplicate cookie names:
and an unused
ReferencesHTTP RFC Field Lines and Combined Field Value
-> Allows multiple headers with the same value if they can be appended, but also one header with multiple comma-separated fields. HTTP/2 RFC 9113 Compressing the Cookie Header Field
HTTP State Management Mechanism RFC 6265 The Cookie Header
DecisionWe decided to use the |
Description
Based on POC implement header and cookie mutators for Istio based JWT handler. Implementation should be the same as in ORY oathkeeper. Other mutators: id_token and hydrator should in error message. Configuration should not change.
ACs:
Reasons
Provide same functionality for mutators as ORY oathkeeper
DoD:
- [ ] publish release notes and What's New updates for Kyma customers- [ ] verify Get started guides- [ ] verify resource limits- [ ] create release and bump in kymaAttachments
https://www.ory.sh/docs/oathkeeper/pipeline/mutator
depends on: #212
part of: #30
PR
The text was updated successfully, but these errors were encountered: