3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-08-04 01:09:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

core/envoy: exclude unauthorized access from local replies (#5108)

Browse source 
* core/envoy: exclude unauthorized access from local replies

* fix test
This commit is contained in:
Caleb Doxsey 2024-05-09 11:09:38 -06:00 • committed by GitHub
parent ab388211f2
commit 568e99fdd4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 68 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

40
config/envoyconfig/http_connection_manager.go
View file

@ -56,9 +56,10 @@ func (b *Builder) buildLocalReplyConfig(
}
data := map[string]any{
"status": "%RESPONSE_CODE%",
"statusText": "%RESPONSE_CODE_DETAILS%",
"requestId": "%STREAM_ID%",
"status": "%RESPONSE_CODE%",
"statusText": "%RESPONSE_CODE_DETAILS%",
"requestId": "%STREAM_ID%",
"responseFlags": "%RESPONSE_FLAGS%",
}
httputil.AddBrandingOptionsToMap(data, options.BrandingOptions)
@ -71,7 +72,38 @@ func (b *Builder) buildLocalReplyConfig(
Mappers: []*envoy_http_connection_manager.ResponseMapper{{
Filter: &envoy_config_accesslog_v3.AccessLogFilter{
FilterSpecifier: &envoy_config_accesslog_v3.AccessLogFilter_ResponseFlagFilter{
ResponseFlagFilter: &envoy_config_accesslog_v3.ResponseFlagFilter{},
ResponseFlagFilter: &envoy_config_accesslog_v3.ResponseFlagFilter{
Flags: []string{
"DC",
"DF",
"DI",
"DO",
"DPE",
"DT",
"FI",
"IH",
"LH",
"LR",
"NC",
"NFCF",
"NR",
"OM",
"RFCF",
"RL",
"RLSE",
"SI",
// "UAEX", // excluded because this response is handled in the authorize service
"UC",
"UF",
"UH",
"UMSDR",
"UO",
"UPE",
"UR",
"URX",
"UT",
},
},
},
},
BodyFormatOverride: &envoy_config_core_v3.SubstitutionFormatString{