set-cookie not allowed on client response in successful ExtAuthz response

[aliotta]

This issue is still not resolved. #7986

I am able to repro on envoyproxy/envoy:v1.36-latest

To get around this I am 307ing the 200 requests to attach a cookie which means there are extra and uneeded http calls being made by the browser.

[agrawroh]

@aliotta Could you please share the config you are using and any logs from Envoy?

[aliotta]

Config:

admin:
  address:
    socket_address:
      address: 0.0.0.0
      port_value: 9901

static_resources:
  listeners:
    - name: listener_0
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 8080 # Envoy listens on this port
      filter_chains:
        - filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http
                use_remote_address: true
                access_log:
                  - name: envoy.access_loggers.stdout
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
                route_config:
                  name: local_route
                  virtual_hosts:
                    - name: web_service_vhost
                      domains: ["*"]
                      routes:
                        - match: { prefix: "/" }
                          route:
                            cluster: web_service_cluster
                http_filters:
                  - name: envoy.filters.http.ext_authz
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
                      transport_api_version: V3
                      failure_mode_allow: false # Deny request if auth service is unavailable or fails
                      with_request_body: # If you need to send request body to auth service
                        max_request_bytes: 8192
                        allow_partial_message: false
                      clear_route_cache: true
                      http_service:
                        server_uri:
                          uri: http://forward-auth:4181 # DNS name of auth service
                          cluster: forward-auth
                          timeout: 0.5s
                        authorization_request:
                          allowed_headers:
                            # Tells Envoy which headers from the original request to send to the auth service
                            patterns:
                              - exact: "authorization"
                              - exact: "x-custom-header-for-auth" # Example
                              - exact: "x-forwarded-proto"
                              - exact: "host"
                              - exact: "cookie"
                              - exact: "accept"
                        authorization_response:
                          # Tells Envoy which headers from the auth service's response to send to the upstream service
                          allowed_upstream_headers:
                            patterns:
                              - exact: "authorization"
                              - exact: "x-authenticated-user"
                              - exact: "x-auth-service-status"
                          # Tells Envoy which headers from the auth service's response to send back to the client
                          allowed_client_headers:
                            patterns:
                              - exact: "x-auth-service-status" # e.g., if you want client to see this
                              - exact: "set-cookie"
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

  clusters:
    - name: web_service_cluster
      connect_timeout: 0.25s
      type: LOGICAL_DNS # Important for Docker Compose service discovery
      dns_lookup_family: V4_ONLY # Important for Docker networking
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: web_service_cluster
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: web # DNS name of hello-world service
                      port_value: 80 # Nginx default port

    - name: forward-auth
      connect_timeout: 0.25s
      type: LOGICAL_DNS # Important for Docker Compose service discovery
      lb_policy: ROUND_ROBIN
      load_assignment:
        cluster_name: forward-auth
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: forward-auth # DNS name of auth service
                      port_value: 4181 # Port our Flask app runs on

[aliotta]

logs.txt - Debug logs

[yanavlasov]

It looks like this is only set for deny case:

envoy/source/extensions/filters/common/ext_authz/ext_authz_http_impl.cc

Line 431 in 40fb1e4

config_->clientHeaderMatchers(),

Likely the cause of this bug.