Authenticator bearer_token token_from query_parameter does not forward token to check_session_url if preserve_path: true

[hunzikerj]

Describe the bug

The bearer_token authenticator does only forward request method/path/headers. If preserve_path is set to true then the query_parameter will not get forwarded as the url is replaced by the check_session_url.

Reproducing the bug

Steps to reproduce the behavior:

Using Oathkeeper according to the example in the documentation.

# Some Access Rule Preserving Path: access-rule-2.yaml
id: access-rule-2
# match: ...
# upstream: ...
authenticators:
  - handler: bearer_token
    config:
      check_session_url: https://session-store-host/check-session
      token_from:
        query_parameter: auth-token
      preserve_path: true

Expected behavior

If preserve_path is set to true then the query_parameter should be appended to the check_session_url in the request.

Example:

https://session-store-host/check-session?auth-token=xxx

Environment

• Version: v0.38.12-beta.1

[aeneasr]

Yup, that makes sense - tracking as a feat request :)

[grantzvolsky]

The preserve_path flag preserves the path in check_session_url because by default it is the path in the request that is forwarded. The counterintuitive property/bug is that while the request path is forwarded by default, the request query is ignored by default, without any option to forward it.

I will submit a PR that forwards the request query by default, which is consistent with forwarding the path by default. This is a breaking change because someone may depend on the query in check_session_url being preserved as it currently is. Should I introduce a new flag, preserve_query, and document it as a breaking change?

[grantzvolsky]

We could also make the preserve_query flag true by default, which would achieve the same effect without any breaking changes.