eveniota commented on code in PR #13708:
URL: https://github.com/apache/trafficserver/pull/13708#discussion_r4280033380
##########
plugins/experimental/access_control/plugin.cc:
##########
@@ -529,12 +529,31 @@ enforceAccessControl(TSHttpTxn txnp, TSRemapRequestInfo
*rri, AccessControlConfi
remapStatus =
handleInvalidToken(txnp, data, reject,
accessTokenStateToHttpStatus(data->_vaState, config), data->_vaState);
} else {
- /* Valid token, if configured extract the token subject to a header,
- * only if we can trust it - token is valid to prevent using it by
mistake */
- if (!config->_extrSubHdrName.empty()) {
- String sub(token->getSubject());
- setHeader(rri->requestBufp, rri->requestHdrp,
config->_extrSubHdrName.c_str(), config->_extrSubHdrName.size(),
- sub.c_str(), sub.size());
+ bool inScope = true;
+ if (config->_enforceScope) {
+ int pathLen = 0;
+ const char *path = TSUrlPathGet(rri->requestBufp,
rri->requestUrl, &pathLen);
+ StringView reqPath(path ? path : "", pathLen);
+ ScopeValidationResult scopeResult = validateScopeDetailed(reqPath,
token->getScope());
+ if (scopeResult != ScopeValidationResult::IN_SCOPE) {
+ inScope = false;
+ if (scopeResult == ScopeValidationResult::INVALID_SCOPE) {
+ data->_vaState = INVALID_SCOPE;
+ } else {
+ data->_vaState = OUT_OF_SCOPE;
+ }
+ remapStatus =
+ handleInvalidToken(txnp, data, reject,
accessTokenStateToHttpStatus(data->_vaState, config), data->_vaState);
+ }
+ }
Review Comment:
The plugin's documentation specifies that out-of-scope and rejected request
paths receive -- invalid-scope-status-code (defaulting to 403), not
--invalid-syntax-status-code (400), as the
token itself is syntactically valid and cryptographically signed. Per
maintainer guidance, mapping to OUT_OF_SCOPE maintains this documented contract
and avoids misreporting valid tokens as malformed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
