Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Swap the order of the CORS filter and the ext_authz filter. #4172

Merged
merged 2 commits into from
May 24, 2022
Merged

Swap the order of the CORS filter and the ext_authz filter. #4172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91f619e
Swap order of auth & cors
Mar 24, 2022
fec0899
CHANGELOG
Mar 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,13 @@ Please see the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest
- Feature: It is now possible to set `propagation_modes` in the `TracingService` config when using
lightstep as the driver. (Thanks to <a href="https://github.com/psalaberria002">Paul</a>!) ([#4179])

- Bugfix: When CORS is specified (either in a `Mapping` or in the `Ambassador` `Module`), CORS
processing will happen before authentication. This corrects a problem where XHR to authenticated
endpoints would fail.

[#4179]: https://github.com/emissary-ingress/emissary/pull/4179

## [2.2.2] TBD
## [2.2.2] February 25, 2022
[2.2.2]: https://github.com/emissary-ingress/emissary/compare/v2.2.1...v2.2.2

### Emissary-ingress and Ambassador Edge Stack
Expand Down
8 changes: 7 additions & 1 deletion docs/releaseNotes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,15 @@ items:
github:
- title: "#4179"
link: https://github.com/emissary-ingress/emissary/pull/4179
- title: CORS now happens before auth
type: bugfix
body: >-
When CORS is specified (either in a <code>Mapping</code> or in the <code>Ambassador</code>
<code>Module</code>), CORS processing will happen before authentication. This corrects a
problem where XHR to authenticated endpoints would fail.

- version: 2.2.2
date: 'TBD'
date: '2022-02-25'
notes:
- title: TLS Secret validation is now opt-in
type: change
Expand Down
9 changes: 5 additions & 4 deletions python/ambassador/ir/ir.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,15 +377,16 @@ def __init__(self, aconf: Config,
IRLogServiceFactory.load_all(self, aconf)

# After the Ambassador and TLS modules are done, we need to set up the
# filter chains. Note that order of the filters matters. Start with auth,
# since it needs to be able to override everything...
self.save_filter(IRAuth(self, aconf))
# filter chains. Note that order of the filters matters. Start with CORS,
# so that preflights will work even for things behind auth.

# ...then deal with the non-configurable cors filter...
self.save_filter(IRFilter(ir=self, aconf=aconf,
rkey="ir.cors", kind="ir.cors", name="cors",
config={}))

# Next is auth...
self.save_filter(IRAuth(self, aconf))

# ...then the ratelimit filter...
if self.ratelimit:
self.save_filter(self.ratelimit, already_saved=True)
Expand Down