openresty / openresty/lua-nginx-module
ngx.req.set_header(key, value ) in kong plugin should throw error for BWS ("bad" whitespace) in header key
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 11.8k
- Forks
- 2.1k
- Avg merge
- 6h 1m
- Merged PRs (30d)
- 6
Description
Current Behavior
Adding header ngx.req.set_header("X-cnn-Service ", "") to a plugin is causing the request to throw HTTP 400 error due to the additional trailing whitespace in header's Key.
reference- field-parsing according to rfc7230 No whitespace is allowed between the header field-name and colon .
Due to a small leading/trailing whitespace mistake , much of the developers time is wasted to find this issue .
Expected Behavior
Two ideas can be proposed
- Trim the leading/trailing whitespace of the header before plugin execution.
- Log the error , that plugin execution failed for the request due to invalid header
Steps To Reproduce
Create a Plugin with the following in access.lua
`
local BasePlugin = require "kong.plugins.base_plugin"
local priorities = require "kong.plugins.priorities"
local plugin_name = "headers-plugin"
local KongHeadersHandler = BasePlugin:extend()
function KongHeadersHandler:new()
KongHeadersHandler.super.new(self, plugin_name)
end
function KongHeadersHandler:access(conf)
KongHeadersHandler.super.access(self)
ngx.req.set_header("X-cnn-Service ", "")
end
KongHeadersHandler.PRIORITY = priorities[plugin_name]
KongHeadersHandler.VERSION = "0.0.1"
return KongHeadersHandler`
kong version 1.1.2
lua version Lua 5.1.4
LuaJIT 2.1.0-beta3
nginx version: openresty/1.13.6.2
LuaRocks main command-line interface /opt/kong/luajit/bin/luarocks 3.2.1
For ngx.header also it should trim white space or throw error instead of sending invalid header
example
header_filter_by_lua_block {
ngx.header.Foo = "blah"
ngx.header["name "] = 'X-12345'
}
output
< Connection: keep-alive
< Foo: blah
< name%20: X-12345
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the trailing-space cases at ngx.req.set_header in the plugin's access.lua and at ngx.header in header_filter_by_lua_block. Read the handling behind these entry points and compare the observed HTTP 400 or encoded header output with RFC 7230; done means the intended invalid-header behavior is defined and covered for both APIs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua, nginx
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100