eveniota commented on code in PR #13708:
URL: https://github.com/apache/trafficserver/pull/13708#discussion_r4280102058
##########
plugins/experimental/access_control/plugin.cc:
##########
@@ -529,12 +529,31 @@ enforceAccessControl(TSHttpTxn txnp, TSRemapRequestInfo
*rri, AccessControlConfi
remapStatus =
handleInvalidToken(txnp, data, reject,
accessTokenStateToHttpStatus(data->_vaState, config), data->_vaState);
} else {
- /* Valid token, if configured extract the token subject to a header,
- * only if we can trust it - token is valid to prevent using it by
mistake */
- if (!config->_extrSubHdrName.empty()) {
- String sub(token->getSubject());
- setHeader(rri->requestBufp, rri->requestHdrp,
config->_extrSubHdrName.c_str(), config->_extrSubHdrName.size(),
- sub.c_str(), sub.size());
+ bool inScope = true;
+ if (config->_enforceScope) {
+ int pathLen = 0;
+ const char *path = TSUrlPathGet(rri->requestBufp,
rri->requestUrl, &pathLen);
+ StringView reqPath(path ? path : "", pathLen);
+ ScopeValidationResult scopeResult = validateScopeDetailed(reqPath,
token->getScope());
Review Comment:
In this plugin, AccessToken instances are not long-lived cached objects
across transactions; each incoming transaction instantiates a token, parses the
cookie, and destroys the token at transaction close. Normalizing at token parse
time would therefore still occur once per transaction, but would add an
unconditional std::string heap allocation to AccessToken::parse() even when
--enforce-scope is disabled (the default). Lazy normalization inside
validateScopeDetailed() ensures zero overhead when scope enforcement is not
used. As noted by the @cmcfarlen , this is optional and kept as-is.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
