fix: preserve semicolon-separated query parameters in proxy requests

proxy/proxy.go

@@ -123,6 +123,14 @@ func (d *Proxy) Rewrite(r *httputil.ProxyRequest) {
 	}
 
 	EnrichRequestedURL(r)
+
+	// Preserve the original query string from the incoming request. Go's httputil.ReverseProxy
+	// calls cleanQueryParams which drops semicolon-separated parameters (e.g. "a=b;c=d") as
+	// they are considered invalid per RFC 3986. However, as an identity proxy, we need to
+	// maintain transparency and pass through the original query parameters to allow backends
+	// to handle them according to their own validation rules.
+	r.Out.URL.RawQuery = r.In.URL.RawQuery
+
 	rl, err := d.r.RuleMatcher().Match(r.Out.Context(), r.Out.Method, r.Out.URL, rule.ProtocolHTTP)
 	if err != nil {
 		*r.Out = *r.Out.WithContext(context.WithValue(r.Out.Context(), director, err))

proxy/proxy_test.go

@@ -394,6 +394,50 @@ func TestProxy(t *testing.T) {
 				r.Header.Set("Connection", "x-arbitrary")
 			},
 		},
+		{
+			d:           "should preserve semicolons in query strings",
+			url:         ts.URL + "/authn-noop/1234?a=b;c=d",
+			rulesRegexp: []rule.Rule{ruleNoOpAuthenticator},
+			rulesGlob:   []rule.Rule{ruleNoOpAuthenticatorGlob},
+			code:        http.StatusOK,
+			messages: []string{
+				"url=/authn-noop/1234?a=b;c=d",
+				"host=" + x.ParseURLOrPanic(backend.URL).Host,
+			},
+		},
+		{
+			d:           "should preserve complex semicolon query strings",
+			url:         ts.URL + "/authn-noop/1234?param1=value1;param2=value2;param3=value3&normal=param",
+			rulesRegexp: []rule.Rule{ruleNoOpAuthenticator},
+			rulesGlob:   []rule.Rule{ruleNoOpAuthenticatorGlob},
+			code:        http.StatusOK,
+			messages: []string{
+				"url=/authn-noop/1234?param1=value1;param2=value2;param3=value3&normal=param",
+				"host=" + x.ParseURLOrPanic(backend.URL).Host,
+			},
+		},
+		{
+			d:           "should preserve trailing semicolon in query strings",
+			url:         ts.URL + "/authn-noop/1234?a=b;",
+			rulesRegexp: []rule.Rule{ruleNoOpAuthenticator},
+			rulesGlob:   []rule.Rule{ruleNoOpAuthenticatorGlob},
+			code:        http.StatusOK,
+			messages: []string{
+				"url=/authn-noop/1234?a=b;",
+				"host=" + x.ParseURLOrPanic(backend.URL).Host,
+			},
+		},
+		{
+			d:           "should preserve URL encoded semicolons in query strings",
+			url:         ts.URL + "/authn-noop/1234?data=value%3Bseparated",
+			rulesRegexp: []rule.Rule{ruleNoOpAuthenticator},
+			rulesGlob:   []rule.Rule{ruleNoOpAuthenticatorGlob},
+			code:        http.StatusOK,
+			messages: []string{
+				"url=/authn-noop/1234?data=value%3Bseparated",
+				"host=" + x.ParseURLOrPanic(backend.URL).Host,
+			},
+		},
 	} {
 		t.Run(fmt.Sprintf("description=%s", tc.d), func(t *testing.T) {
 			testFunc := func(t *testing.T, strategy configuration.MatchingStrategy, rules []rule.Rule) {