pomerium / pomerium / 26914170053

52%

Build Type

push

github

Committed by web-flow

Commit Message

config: additional jwt_claims_headers validation (#6419)

Currently it's possible to mix up the jwt_claims_headers option syntax
in such a way that the config parses successfully, but then Pomerium
serves a completely blank error web page. This can happen if you
accidentally include a '-' before the headers, like this:

    jwt_claims_headers:
      - X-Pomerium-Claim-Email: email

This validates without an error, but results in the HTTP header name
"x-pomerium-claim-map[x-pomerium-claim-email:email]", which Envoy then
rejects with a confusing error.

Add an explicit check to catch this mistake, in order to fail early with
a clearer error message.

A similar situation occurs if you explicitly include some invalid
character in a header name, e.g.:

    jwt_claims_headers:
      - X:Not:OK: email

Add a check for this case as well.

Coverage Stats

6 of 6 new or added lines in 1 file covered. (100.0%)

24 existing lines in 6 files now uncovered.

36750 of 70409 relevant lines covered (52.2%)

463.17 hits per line