Add support to parameterize unauthenticated paths #12668
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
calvn
reviewed
Sep 30, 2021
calvn
reviewed
Sep 30, 2021
|
Looks like CI caught a failure related to these changes. |
If we ever encounter a mismatched segment, break and set a flag to prevent false positives for prefix matches. If it is a match we need to do a prefix check. But we should not return unless HasPrefix also evaluates to true. Otherwise we should let the for loop continue to check other possibilities and only return false once all wildcard paths have been evaluated.
ncabatoff
reviewed
Oct 6, 2021
ncabatoff
reviewed
Oct 6, 2021
calvn
reviewed
Oct 6, 2021
calvn
approved these changes
Oct 7, 2021
calvn
approved these changes
Oct 8, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds support to parameterize unauthenticated paths for a framework.Backend. This is needed to allow the following unauthenticated API paths for the upcoming OIDC Provider feature:
oidc/provider/+/.well-known/*oidc/provider/+/tokenBackground
Today, unauthenticated paths get stored in the loginPaths in the router when the backend is mounted. The structure used is a radix tree which is ultimately stored in an
atomic.Value.The approach used in this PR is to store any unauthenticated paths containing wildcards in an array* of pre-split slices. All other unauthenticated paths (not containing wildcards) will continue to be stored in a radix tree. This PR introduces a new struct
loginPathsEntryto hold both the array and radix tree.*Note that this sits in the hot path of requests so we are micro-optimizing by storing pre-split slices of path segments.
Alternative approaches
Several alternative approaches were considered:
*character that is currently used to indicate a prefix match has a different meaning as a regular expression