envoyproxy / envoyproxy/envoy

ext_authz(http): Envoy turns AuthorizationResponse status 500 into 403 and drops body

Open
#14,001 27 comments 0 reactions 0 assignees View on GitHub
area/ext_authz help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

*Title*: ext_authz(http): Envoy turns AuthorizationResponse status 500 into 403 and drops body

*Description*:
1. User makes an HTTP request against Envoy.
1. Envoy makes AuthorizationRequest to ext_authz filter's http server.
1. ext_authz server replies with 503 and a body.
1. Envoy returns 403 and no body.

*Repro steps*:
This came up as part of a project so it's easier to include instructions for that project:
```sh
# Clone and checkout branch made for reproducing this issue (see last commit)
git clone git@github.com:arrikto/oidc-authservice.git
cd oidc-authservice
git checkout feature-envoy-ext-authz-repo

# Run the E2E test to get a K3d cluster up with everything running.
# The test will fail, but it's expected.
make bin/deps
make e2e

# Port-forward the service locally
export KUBECONFIG=$HOME/.k3d/kubeconfig-e2e-test-cluster.yaml
kubectl port-forward -n istio-system svc/istio-ingressgateway 8080:80

# Make a request and see that it returns a 403
curl -v http://localhost:8080
```

*Config*:
Here is the config dump taken from port 15000 of the istio ingressgateway proxy:
[config_dump.log](https://github.com/envoyproxy/envoy/files/5532915/config_dump.log)

*Logs*:
[access_log.log](https://github.com/envoyproxy/envoy/files/5532921/access_log.log)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.