envoyproxy / envoyproxy/gateway

Docs: describe defaults of Underscore and slashes

Open
#5,851 3 comments 0 reactions 0 assignees View on GitHub
documentation stale
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
We moved to envoygateway last weekend (from istio ingress gateway). Worked like a charm, except for a few issues:
- we run a gitlab instance, which meant the escapedSlashesAction default broke a lot of API calls (gitlab can use `%2F` in the URL instead of a project ID)
- due to an error in http/2 client code we sent a header containing an underscore for certain requests, resulting in a RST_STREAM responses, with the fairly cryptic 'internal error' description (though that may be Java's http client translating an error code?)

We found the cause of the escaped slashes quickly, since we could see the redirects happening, the underscore was much harder to discover. This was mostly because instead of returning a 400 status code, the RST_STREAM meant we started searching deep in http/2 connection issues (I was all the way into envoy half-closing connections causing a http1.1 upstream connection close to result in a http/2 RST_STREAM to the downstream). It was not until I discovered we accidentally sent a header containing an underscore I tried to send a header without, searched deep in the api reference of the docs and found that envoygateway defaults to rejecting headers containing an underscore.

I have 3 questions:
- could this information be shown in the docs outside of the API reference? (e.g. as part of the security tasks? Something like 'sanitizing requests`)
- is there a specific reason envoy sends an RST_STREAM for http/2 but a 400 bad error for http1.1? I prefer my http requests to have identical errors no matter the specific http version.
- would it be possible to have both cases return a 400 error with the 'Header keys may not contain underscores' in the body, instead of the RST_STREAM and 400 error with body 'Bad Request'?

FYI, our error was forgetting to add `user-agent: ` before the header value, which resulted in the user-agent value becoming the header key. The value did contain an underscore.
[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.