envoyproxy / envoyproxy/gateway
Docs: describe defaults of Underscore and slashes
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
We moved to envoygateway last weekend (from istio ingress gateway). Worked like a charm, except for a few issues:
- we run a gitlab instance, which meant the escapedSlashesAction default broke a lot of API calls (gitlab can use `%2F` in the URL instead of a project ID)
- due to an error in http/2 client code we sent a header containing an underscore for certain requests, resulting in a RST_STREAM responses, with the fairly cryptic 'internal error' description (though that may be Java's http client translating an error code?)
We found the cause of the escaped slashes quickly, since we could see the redirects happening, the underscore was much harder to discover. This was mostly because instead of returning a 400 status code, the RST_STREAM meant we started searching deep in http/2 connection issues (I was all the way into envoy half-closing connections causing a http1.1 upstream connection close to result in a http/2 RST_STREAM to the downstream). It was not until I discovered we accidentally sent a header containing an underscore I tried to send a header without, searched deep in the api reference of the docs and found that envoygateway defaults to rejecting headers containing an underscore.
I have 3 questions:
- could this information be shown in the docs outside of the API reference? (e.g. as part of the security tasks? Something like 'sanitizing requests`)
- is there a specific reason envoy sends an RST_STREAM for http/2 but a 400 bad error for http1.1? I prefer my http requests to have identical errors no matter the specific http version.
- would it be possible to have both cases return a 400 error with the 'Header keys may not contain underscores' in the body, instead of the RST_STREAM and 400 error with body 'Bad Request'?
FYI, our error was forgetting to add `user-agent: ` before the header value, which resulted in the user-agent value becoming the header key. The value did contain an underscore.
[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.