Add support to extract from different identifier on JWT under Security Policy

[ardikabs]

Description:
Follow up from #1930.

Currently JWT only enables the default behavior to extract the JWT identifier from an HTTP request which uses Authorization header using Bearer format as well as query param using access_token.
Thus, in my current use case, the requirement states that the JWT needs to be extracted from the Cookie, but because EG does not support this, I have to modify it using the Envoy Gateway Extension service. Hence, it would be much better if EG could support this behavior directly.

Proposal:

Add support to extract the JWT identifier from available options such as from_cookies, from_headers, and/or from_params, while keeping the default behavior if there are no extractors included in the API.

We could introduce new fields for these additional extractors like below;

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: jwt-example
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: foo
  jwt:
    providers:
      - name: example
        remoteJWKS:
          uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
        fromCookies:
          - session_access_token
        fromParams:
          - access_token
        fromHeaders:
          - name: x-access-token
            valuePrefix: ""

[optional Relevant Links:]

• Envoy JWT Authentication.

[ardikabs]

/assign

[ardikabs]

hi @arkodg, regarding #2206 (comment), apparently I have a use case now to support multiple extractors from headers (Authorization) or cookies, can I work on that and refer to this issue?

[arkodg]

sure go for it @ardikabs can you create a sub issue for it, will be easier to track, thanks