hashicorp / hashicorp/vault-client-dotnet

Requests to vault via YARP reverse proxy

Open
#204 0 comments 4 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
48
Forks
6
PR merge metrics
No merged PRs in 30d

Description

Hi, I'm using vault client in a setup where my code fills up secrets in the vault which resides behind reverse proxy (YARP). In this setup I observed unexpected behavior when writing secrets under paths containing `/` . i.e. `my/custom/path`. In this scenario the secrets get incorrectly written into `my%2fcustom%2fpath` which I don't think is even a valid path (at least vault ui gets confused when you click on such item).

I did some investigation on my end and I was able to get into the root cause of it, which is a coefficient of two things:
1. Vault C# Client encodes secret paths in the POST request URL (it's done here: https://github.com/hashicorp/vault-client-dotnet/blob/main/src/Vault/Client/ApiClient.cs#L372). This produces requests like this: `/v1/2c78501d-73c5-4844-908e-408d3a6440c6/data/my%2fcustom%2fpath` which does not seem to be an issue on its own because vault seems to handle requests like this correctly.
2. YARP proxy has a known issue and does not properly recognize `%2f` and because of this it gets double encoded while rewriting request to the host (it's reported here: https://github.com/microsoft/reverse-proxy/issues/1419)

I'm aware it's not particularly issue with the vault client itself, but this might have some significant impact on the client library users since you don't always know what proxies exist in between the client and the vault server.

This leads me to the questions:
1. Is this encoding on the client side required? I did some tests and it seems the vault handles not-encoded paths as well as encoded. i.e. both of these requests to vault work just fine:
```
/v1/2c78501d-73c5-4844-908e-408d3a6440c6/data/my%2fcustom%2fpath
/v1/2c78501d-73c5-4844-908e-408d3a6440c6/data/my/custom/path
```
2. Do you think it would be worth to have it configurable for the client library user (whether encoding is enabled or not)?
3. What would be your recommendation to get it working in my case? (just for the record, changing reverse proxy is not an option)

I developed a workaround of supplying custom `HttpClientHandler` into the `VaultConfiguration` which decodes the path in the URL before sending request, but I'm not sure how safe it is. Could you give me some advice on this as well?

## Additional context

This is how it looks in the vault UI
![image](https://github.com/user-attachments/assets/285d907f-cecc-4a41-ab3d-f48537dbf98a)

Contributor guide

Open the contributing guide

Research direction

Start with the URL construction in src/Vault/Client/ApiClient.cs around line 372 and review how VaultConfiguration accepts a custom HttpClientHandler. Reproduce a secret write through YARP using a path such as my/custom/path, then determine whether encoding should remain fixed or become configurable. Done means an agreed safe behavior or recommendation for YARP users, with the resulting request behavior verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.