liquidvotingio / liquidvotingio/auth
Validate auth url encoded in /_external-auth-%v?
Nobody has claimed this yet.
- Dominant language
- Elixir
- Stars
- 1
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
It turns out nginx ingress' external authentication tacks on an unexpected extra _external-auth-xxxx path to the subrequest sent to the auth-url. 9bf59d890f0bc27c7957768417ece1cf8e53501b handles it, but ignores an encoded string at its end.
This string seems to be the auth-url itself, encoded:
My initial guess (haven't found any documentation regarding it) would be this is a way to check that the subrequest is indeed coming from the ingress and not from somewhere else. If so, validating it against the domain assigned to the service in k8s would be an extra layer of security.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing commit 9bf59d890f0bc27c7957768417ece1cf8e53501b and the linked ingress-nginx template.go reference around line 428. Determine how the encoded auth-url appears in the /_external-auth-%v? subrequest and define the expected validation behavior. Done means the encoded suffix is handled safely, with coverage for valid and invalid requests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elixir, kubernetes, nginx
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100