jwt_authn: fix a bug where JWT with wrong issuer is allowed in allow_missing case#303
Merged
istio-testing merged 3 commits intoistio:release-1.9from Feb 26, 2021
Merged
Conversation
jacob-delgado
approved these changes
Feb 26, 2021
added 2 commits
February 26, 2021 10:41
|
@jacob-delgado I think normally we just do a batched backport of envoy fixes, since branches are 1:1 mapping now. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When allow_missing is used inside RequiresAny, the requests with JWT with wrong issuer are accepted. This is a bug, allow_missing should only allow requests without any JWT.
This change fixed the above issue by preserving JwtUnknownIssuer in allow_missing case.
Change details:
JwtUnkownIssuer error got converted to JwtMissing in error aggregation inside VerifyAny object. This is the root cause. Such conversion is not needed.
Fix is to preserve JwtUknownIssuer in the error aggregation.
Risk Level: Low
Testing: unit-tested
Docs Changes: N/A
Release Notes: Yes
Cherrypick: envoyproxy#15199