Struct OidcHttpContext 

pub struct OidcHttpContext {
    pub open_id_providers: Vec<OpenIdProvider>,
    pub plugin_config: Arc<V2PluginConfiguration>,
    pub token_id: Option<u32>,
    pub request_id: String,
}

The OidcHttpContext is the main filter struct and responsible for the OpenID authentication flow. Requests arriving are checked for a valid cookie. If the cookie is valid, the request is forwarded. If the cookie is not valid, the user is redirected to the authorization endpoint.

Fields

open_id_providers: Vec<OpenIdProvider>

The configuration of the filter which mainly contains the open id configuration and the keys to validate the JWT

plugin_config: Arc<V2PluginConfiguration>

Plugin configuration parsed from the envoy configuration

token_id: Option<u32>

Token id of the current request

request_id: String

ID of the current request

Implementations

impl OidcHttpContext

Helper functions for the `OidcHttpContext`` struct.

fn request_should_be_excluded(&self, host: &str, path: &str, url: &Url) -> bool

Check if the request is excluded.

Arguments

• host - The host of the request
• path - The path of the request
• url - The URL of the request

Returns

• true - If the request is excluded
• false - If the request is not excluded

fn validate_cookie(&self) -> Result<AuthorizationState, PluginError>

Check if the cookie is valid and if the token is valid.

Returns

• Ok(AuthorizationState) - If the cookie is valid and the token is valid
• Err(PluginError) - If the cookie is not valid or the token is not valid

fn validate_token(&self, token: &str, issuer: &str) -> Result<(), PluginError>

Validate the token using the JWT library and a given issuer. This function checks for the given issuer and audience and verifies the signature with the public keys loaded from the JWKs endpoint.

Arguments

• token - The token to validate
• issuer - The issuer to validate the token against

Returns

A result with the following variants:

• Ok(()) - If the token is valid
• Err(PluginError) - If the token is invalid

fn provider_selection(&mut self, query: &str) -> Result<(), PluginError>

Redirect to the authorization endpoint with the selected provider.

Arguments

• query - The query string from the provider selection callback

fn exchange_code_for_token(&mut self, path: String) -> Result<(), PluginError>

Exchange the code for a token using the token endpoint. This function is called when the user is redirected back to the callback URL. The code is extracted from the URL and exchanged for a token using the token endpoint.

Arguments

• path - The path of the request

Returns

• Ok(()) - If the token is exchanged successfully
• Err(PluginError) - If the token exchange fails

fn store_token_in_cookie( &mut self, token_id: u32, body_size: usize, ) -> Result<(), PluginError>

Store the token from the token response in an encrypted cookie.

Arguments

• token_id - The token id of the response
• body_size - The size of the response body

Returns

• Ok(()) - If the token is stored in the cookie successfully
• Err(PluginError) - If the token could not be stored in the cookie

fn is_same_origin_get(&self) -> bool

Returns true when the request is a same-origin (or non-browser) GET.

Used to mitigate logout / cookie-reset CSRF from cross-site navigations. Sec-Fetch-Site is absent in older browsers and non-browser clients; those are allowed. Modern browsers send cross-site for attacker-driven top-level GETs.

fn logout(&self) -> Action

Clear the session cookies and redirect to the base path or end_session_endpoint.

Always clears cookies via Set-Cookie with Max-Age=0, even when the session is missing or undecryptable (HttpOnly cookies cannot be cleared from the browser).

fn clear_cookies(&self) -> Action

Clear the session cookies and redirect to the base path.

Unlike [logout], this does not redirect to the OIDC provider’s end-session endpoint. It is meant for error-recovery: the user’s cookies are corrupt or invalid, so we just wipe them and let re-authentication happen on the next request.

fn generate_auth_page(&self)

Show the auth page or redirect to the authorization endpoint.

pub fn redirect_to_authorization_endpoint( &self, open_id_provider: &OpenIdProvider, return_to: Option<String>, ) -> Action

Redirect to the authorization_endpoint by sending a HTTP response with a 307 status code. This function generates a PKCE code verifier and challenge, creates a session struct, encrypts and encodes the session, and sets the cookie headers.

Arguments

• open_id_provider - The OpenID provider to redirect to
• return_to - The original path to redirect to after login

fn append_headers(&self, auth_state: &AuthorizationState)

Append the access token and id token to the request headers.

Arguments

• auth_state - The authorization state containing the access token and id token

fn get_cookie(&self, name: &str) -> Option<String>

Get the cookie of the HTTP request by name

Arguments

• name - The name of the cookie to search for

Returns

The value of the cookie if found, None otherwise

fn get_host(&self) -> Option<String>

Get the host of the HTTP request

Returns

The host is searched in the request headers. If the host is found, the value is returned.

fn filter_proxy_cookies(&self)

Filter non proxy cookies by checking the cookie name. This function removes all cookies from the request that do not match the cookie name to prevent the cookie from being forwarded to the upstream service.

pub fn get_session_cookie_as_string(&self) -> Result<String, PluginError>

Helper function to get the session cookie as a string by getting the cookie from the request headers and concatenating all cookie parts.

Returns

The session cookie as a string if found, an error otherwise

pub fn get_nonce(&self) -> Result<String, PluginError>

impl OidcHttpContext

pub fn show_error_page( &self, status_code: u32, title: &str, message: &str, show_reset_button: bool, )

Trait Implementations

impl Context for OidcHttpContext

This context is used to process HTTP responses from the token endpoint.

fn on_http_call_response( &mut self, token_id: u32, _: usize, body_size: usize, _: usize, )

This function catches the response from the token endpoint. We use an inner function to handle errors more easily.

fn get_current_time(&self) -> SystemTime

fn get_property(&self, path: Vec<&str>) -> Option<Vec<u8>>

fn set_property(&self, path: Vec<&str>, value: Option<&[u8]>)

fn get_shared_data(&self, key: &str) -> (Option<Vec<u8>>, Option<u32>)

fn set_shared_data( &self, key: &str, value: Option<&[u8]>, cas: Option<u32>, ) -> Result<(), Status>

fn remove_shared_data(&self, key: &str, cas: Option<u32>) -> Result<(), Status>

fn register_shared_queue(&self, name: &str) -> u32

fn resolve_shared_queue(&self, vm_id: &str, name: &str) -> Option<u32>

fn dequeue_shared_queue(&self, queue_id: u32) -> Result<Option<Vec<u8>>, Status>

fn enqueue_shared_queue( &self, queue_id: u32, value: Option<&[u8]>, ) -> Result<(), Status>

fn dispatch_http_call( &self, upstream: &str, headers: Vec<(&str, &str)>, body: Option<&[u8]>, trailers: Vec<(&str, &str)>, timeout: Duration, ) -> Result<u32, Status>

fn get_http_call_response_headers(&self) -> Vec<(String, String)>

fn get_http_call_response_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn get_http_call_response_header(&self, name: &str) -> Option<String>

fn get_http_call_response_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn get_http_call_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn get_http_call_response_trailers(&self) -> Vec<(String, String)>

fn get_http_call_response_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn get_http_call_response_trailer(&self, name: &str) -> Option<String>

fn get_http_call_response_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn dispatch_grpc_call( &self, upstream_name: &str, service_name: &str, method_name: &str, initial_metadata: Vec<(&str, &[u8])>, message: Option<&[u8]>, timeout: Duration, ) -> Result<u32, Status>

fn on_grpc_call_response( &mut self, _token_id: u32, _status_code: u32, _response_size: usize, )

fn get_grpc_call_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn cancel_grpc_call(&self, token_id: u32)

fn open_grpc_stream( &self, cluster_name: &str, service_name: &str, method_name: &str, initial_metadata: Vec<(&str, &[u8])>, ) -> Result<u32, Status>

fn on_grpc_stream_initial_metadata( &mut self, _token_id: u32, _num_elements: u32, )

fn get_grpc_stream_initial_metadata(&self) -> Vec<(String, Vec<u8>)>

fn get_grpc_stream_initial_metadata_value(&self, name: &str) -> Option<Vec<u8>>

fn send_grpc_stream_message( &self, token_id: u32, message: Option<&[u8]>, end_stream: bool, )

fn on_grpc_stream_message(&mut self, _token_id: u32, _message_size: usize)

fn get_grpc_stream_message( &mut self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn on_grpc_stream_trailing_metadata( &mut self, _token_id: u32, _num_elements: u32, )

fn get_grpc_stream_trailing_metadata(&self) -> Vec<(String, Vec<u8>)>

fn get_grpc_stream_trailing_metadata_value(&self, name: &str) -> Option<Vec<u8>>

fn cancel_grpc_stream(&self, token_id: u32)

fn close_grpc_stream(&self, token_id: u32)

fn on_grpc_stream_close(&mut self, _token_id: u32, _status_code: u32)

fn get_grpc_status(&self) -> (u32, Option<String>)

fn on_foreign_function(&mut self, _function_id: u32, _arguments_size: usize)

fn call_foreign_function( &self, function_name: &str, arguments: Option<&[u8]>, ) -> Result<Option<Vec<u8>>, Status>

fn on_done(&mut self) -> bool

fn done(&self)

impl HttpContext for OidcHttpContext

The context is used to process incoming HTTP requests when the filter is configured.

Flow

• Check for excluded hosts, paths or URLs and forward the request if excluded
• Check for health route and return 200
• Check for logout route and clear cookies
• Check for provider selection route and redirect to authorization endpoint
• Check for code callback route and exchange code for token
• Validate cookie and forward request if valid
• If the cookie is not valid, generate the auth page or redirect to the authorization endpoint.

fn on_http_request_headers(&mut self, _: usize, _: bool) -> Action

This function is called when the request headers are received.

fn get_http_request_headers(&self) -> Vec<(String, String)>

fn get_http_request_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_request_headers(&self, headers: Vec<(&str, &str)>)

fn set_http_request_headers_bytes(&self, headers: Vec<(&str, &[u8])>)

fn get_http_request_header(&self, name: &str) -> Option<String>

fn get_http_request_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_request_header(&self, name: &str, value: Option<&str>)

fn set_http_request_header_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_request_header(&self, name: &str, value: &str)

fn add_http_request_header_bytes(&self, name: &str, value: &[u8])

fn remove_http_request_header(&self, name: &str)

fn on_http_request_body( &mut self, _body_size: usize, _end_of_stream: bool, ) -> Action

fn get_http_request_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn set_http_request_body(&self, start: usize, size: usize, value: &[u8])

fn on_http_request_trailers(&mut self, _num_trailers: usize) -> Action

fn get_http_request_trailers(&self) -> Vec<(String, String)>

fn get_http_request_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_request_trailers(&self, trailers: Vec<(&str, &str)>)

fn set_http_request_trailers_bytes(&self, trailers: Vec<(&str, &[u8])>)

fn get_http_request_trailer(&self, name: &str) -> Option<String>

fn get_http_request_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_request_trailer(&self, name: &str, value: Option<&str>)

fn set_http_request_trailer_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_request_trailer(&self, name: &str, value: &str)

fn add_http_request_trailer_bytes(&self, name: &str, value: &[u8])

fn remove_http_request_trailer(&self, name: &str)

fn resume_http_request(&self)

fn reset_http_request(&self)

fn on_http_response_headers( &mut self, _num_headers: usize, _end_of_stream: bool, ) -> Action

fn get_http_response_headers(&self) -> Vec<(String, String)>

fn get_http_response_headers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_response_headers(&self, headers: Vec<(&str, &str)>)

fn set_http_response_headers_bytes(&self, headers: Vec<(&str, &[u8])>)

fn get_http_response_header(&self, name: &str) -> Option<String>

fn get_http_response_header_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_response_header(&self, name: &str, value: Option<&str>)

fn set_http_response_header_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_response_header(&self, name: &str, value: &str)

fn add_http_response_header_bytes(&self, name: &str, value: &[u8])

fn remove_http_response_header(&self, name: &str)

fn on_http_response_body( &mut self, _body_size: usize, _end_of_stream: bool, ) -> Action

fn get_http_response_body( &self, start: usize, max_size: usize, ) -> Option<Vec<u8>>

fn set_http_response_body(&self, start: usize, size: usize, value: &[u8])

fn on_http_response_trailers(&mut self, _num_trailers: usize) -> Action

fn get_http_response_trailers(&self) -> Vec<(String, String)>

fn get_http_response_trailers_bytes(&self) -> Vec<(String, Vec<u8>)>

fn set_http_response_trailers(&self, trailers: Vec<(&str, &str)>)

fn set_http_response_trailers_bytes(&self, trailers: Vec<(&str, &[u8])>)

fn get_http_response_trailer(&self, name: &str) -> Option<String>

fn get_http_response_trailer_bytes(&self, name: &str) -> Option<Vec<u8>>

fn set_http_response_trailer(&self, name: &str, value: Option<&str>)

fn set_http_response_trailer_bytes(&self, name: &str, value: Option<&[u8]>)

fn add_http_response_trailer(&self, name: &str, value: &str)

fn add_http_response_trailer_bytes(&self, name: &str, value: &[u8])

fn remove_http_response_trailer(&self, name: &str)

fn resume_http_response(&self)

fn reset_http_response(&self)

fn send_http_response( &self, status_code: u32, headers: Vec<(&str, &str)>, body: Option<&[u8]>, )

fn send_grpc_response( &self, grpc_status: GrpcStatusCode, grpc_status_message: Option<&str>, custom_metadata: Vec<(&str, &[u8])>, )

fn on_log(&mut self)