Support of allowed_client_headers_on_success in extAuth http SecurityPolicy

[gerrieg]

We need to set a cookie in our ext auth service, for this we need allowed_client_headers_on_success

Currently we use EnvoyPatchPolicy to add the configuration, but native support would be great

Thank you

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[svrakitin]

Would really like to get support for allowed_client_headers and allowed_client_headers_on_success as it currently forces us to use EnvoyPatchPolicy. I also see that the code handling headers like headersToBackend assumes a list of headers vs. a StringMatcher, which makes it impossible to handle header prefixes.

I'd like to contribute, but it seems like it needs a much bigger cleanup and someone with more context. :)

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[mou]

We also have same requirements. Our ext_authz service is responsible for ratelimiting decisions, so the rate-limit headers it emits should be passed downstream. Envoy proxy allows to implement it, and we want Envoy Gateway to support this capability as well.

[shnipov]

Yeah, this will remove a lot of pain for us too. Just clean config, no more dirty workarounds.