feat(openid-connect): add set_raw_id_token_header option - #13616
Conversation
Add a new boolean plugin option `set_enc_id_token_header` (default: false) that, when enabled, forwards the raw RS256-signed ID token JWT to upstream services via the `X-Enc-ID-Token` request header. Unlike the existing `X-ID-Token` header (which contains `base64(JSON(decoded_claims))` with no cryptographic signature), `X-Enc-ID-Token` carries the original signed token that can be verified against the identity provider's JWKS endpoint. Implementation notes: - The header is cleared at rewrite entry to prevent client injection. - When the user has explicitly restricted `session_contents`, the plugin automatically adds `enc_id_token` to the list so the raw JWT is persisted in the session by lua-resty-openidc. - When `session_contents` is nil (the default), lua-resty-openidc stores all session data including `enc_id_token`, so no action is needed. - The feature is only available in the full OIDC session flow (not in the bearer/introspection path, where no session exists). Closes apache#13615
dosubot
Bot
added
size:L
…d_token_header X-Enc-ID-Token exposed lua-resty-openidc's internal session key name, which is unintelligible to gateway users. Rename the option and header to match the field's actual purpose
There was a problem hiding this comment.
Hold on a moment.
What does enc mean? What is it an abbreviation for? encrypt?
If so, JWT does not involve encryption. Its payload is always in plaintext; JWT is merely a signature, not encryption. It seems more appropriate to call it raw_id_token.
This corresponds to the stripped id_token currently provided.
|
adding on to what @bzp2010 said, it might be worthwile to make the header name configurable. |
nic-6443
changed the title
|
@bzp2010 The code already uses @shreemaan-abhishek I don't think we need to add configuration options for now. There are already several headers in this plugin without corresponding configuration options. We can add them all together when there is demand. |
That is correct, thanks for changing it 🙏
That's, I basically tried to follow the other header options to maintain consistency. |
5 participants
Description
Add a new boolean plugin option
set_raw_id_token_header(default:false) that, whenenabled, forwards the raw RS256-signed ID token JWT to upstream via the
X-Raw-ID-Tokenrequest header.
Unlike the existing
X-ID-Tokenheader (which containsbase64(JSON(decoded_claims))withno cryptographic signature),
X-Raw-ID-Tokencarries the original signed token verifiableagainst the identity provider's JWKS endpoint.
Implementation details:
ensures
enc_id_tokenis included so the raw JWT is persisted in the session bylua-resty-openidc. When
session_contentsis nil (the default), lua-resty-openidc stores allsession data including
enc_id_token, so no action is needed.no session exists).
Which issue(s) this PR fixes:
Fixes #13615
Checklist
APISIX mailing list first)