envoyproxy / envoyproxy/gateway

Docs: describe defaults of Underscore and slashes

Aperta
#5,851 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
documentation stale
Lingua principale
Go
Stelle
3k
Fork
864
Merge medio
2g 2h
PR unite (30g)
140

Descrizione

*Description*:
We moved to envoygateway last weekend (from istio ingress gateway). Worked like a charm, except for a few issues:
- we run a gitlab instance, which meant the escapedSlashesAction default broke a lot of API calls (gitlab can use `%2F` in the URL instead of a project ID)
- due to an error in http/2 client code we sent a header containing an underscore for certain requests, resulting in a RST_STREAM responses, with the fairly cryptic 'internal error' description (though that may be Java's http client translating an error code?)

We found the cause of the escaped slashes quickly, since we could see the redirects happening, the underscore was much harder to discover. This was mostly because instead of returning a 400 status code, the RST_STREAM meant we started searching deep in http/2 connection issues (I was all the way into envoy half-closing connections causing a http1.1 upstream connection close to result in a http/2 RST_STREAM to the downstream). It was not until I discovered we accidentally sent a header containing an underscore I tried to send a header without, searched deep in the api reference of the docs and found that envoygateway defaults to rejecting headers containing an underscore.

I have 3 questions:
- could this information be shown in the docs outside of the API reference? (e.g. as part of the security tasks? Something like 'sanitizing requests`)
- is there a specific reason envoy sends an RST_STREAM for http/2 but a 400 bad error for http1.1? I prefer my http requests to have identical errors no matter the specific http version.
- would it be possible to have both cases return a 400 error with the 'Header keys may not contain underscores' in the body, instead of the RST_STREAM and 400 error with body 'Bad Request'?

FYI, our error was forgetting to add `user-agent: ` before the header value, which resulted in the user-agent value becoming the header key. The value did contain an underscore.
[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.