Skip to content

fix: add validation for duplicated API keys #5955

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 9, 2025
Merged

fix: add validation for duplicated API keys #5955

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions internal/gatewayapi/securitypolicy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1124,6 +1124,8 @@ func (t *Translator) buildAPIKeyAuth(
}

credentials := make(map[string]ir.PrivateBytes)
seenKeys := make(sets.Set[string])

for _, ref := range policy.Spec.APIKeyAuth.CredentialRefs {
credentialsSecret, err := t.validateSecretRef(
false, from, ref, resources)
Expand All @@ -1134,6 +1136,13 @@ func (t *Translator) buildAPIKeyAuth(
if _, ok := credentials[clientid]; ok {
continue
}

keyString := string(key)
if seenKeys.Has(keyString) {
return nil, errors.New("duplicated API key")
}

seenKeys.Insert(keyString)
credentials[clientid] = key
}
}
Expand Down
62 changes: 62 additions & 0 deletions internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.in.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
gateways:
- apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
namespace: envoy-gateway
name: gateway-1
spec:
gatewayClassName: envoy-gateway-class
listeners:
- name: http
protocol: HTTP
port: 80
hostname: "*.envoyproxy.io"
allowedRoutes:
namespaces:
from: All
httpRoutes:
- apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
namespace: default
name: httproute-1
spec:
hostnames:
- gateway.envoyproxy.io
parentRefs:
- namespace: envoy-gateway
name: gateway-1
sectionName: http
rules:
- matches:
- path:
value: "/"
backendRefs:
- name: service-1
port: 8080
securityPolicies:
- apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
namespace: default
name: policy-for-route-1
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: httproute-1
apiKeyAuth:
extractFrom:
- headers: ["X-API-KEY"]
credentialRefs:
- name: "credential-1"
secrets:
- apiVersion: v1
kind: Secret
metadata:
namespace: default
name: credential-1
data:
client1: "a2V5MQ=="
client2: "a2V5Mg=="
client3: "a2V5Mg=="
183 changes: 183 additions & 0 deletions internal/gatewayapi/testdata/httproute-with-api-key-auth-duplicated-api-key.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,183 @@
gateways:
- apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
creationTimestamp: null
name: gateway-1
namespace: envoy-gateway
spec:
gatewayClassName: envoy-gateway-class
listeners:
- allowedRoutes:
namespaces:
from: All
hostname: '*.envoyproxy.io'
name: http
port: 80
protocol: HTTP
status:
listeners:
- attachedRoutes: 1
conditions:
- lastTransitionTime: null
message: Sending translated listener configuration to the data plane
reason: Programmed
status: "True"
type: Programmed
- lastTransitionTime: null
message: Listener has been successfully translated
reason: Accepted
status: "True"
type: Accepted
- lastTransitionTime: null
message: Listener references have been resolved
reason: ResolvedRefs
status: "True"
type: ResolvedRefs
name: http
supportedKinds:
- group: gateway.networking.k8s.io
kind: HTTPRoute
- group: gateway.networking.k8s.io
kind: GRPCRoute
httpRoutes:
- apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
creationTimestamp: null
name: httproute-1
namespace: default
spec:
hostnames:
- gateway.envoyproxy.io
parentRefs:
- name: gateway-1
namespace: envoy-gateway
sectionName: http
rules:
- backendRefs:
- name: service-1
port: 8080
matches:
- path:
value: /
status:
parents:
- conditions:
- lastTransitionTime: null
message: Route is accepted
reason: Accepted
status: "True"
type: Accepted
- lastTransitionTime: null
message: Resolved all the Object references for the Route
reason: ResolvedRefs
status: "True"
type: ResolvedRefs
controllerName: gateway.envoyproxy.io/gatewayclass-controller
parentRef:
name: gateway-1
namespace: envoy-gateway
sectionName: http
infraIR:
envoy-gateway/gateway-1:
proxy:
listeners:
- address: null
name: envoy-gateway/gateway-1/http
ports:
- containerPort: 10080
name: http-80
protocol: HTTP
servicePort: 80
metadata:
labels:
gateway.envoyproxy.io/owning-gateway-name: gateway-1
gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
name: envoy-gateway/gateway-1
namespace: envoy-gateway-system
securityPolicies:
- apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
creationTimestamp: null
name: policy-for-route-1
namespace: default
spec:
apiKeyAuth:
credentialRefs:
- group: null
kind: null
name: credential-1
extractFrom:
- headers:
- X-API-KEY
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: httproute-1
status:
ancestors:
- ancestorRef:
group: gateway.networking.k8s.io
kind: Gateway
name: gateway-1
namespace: envoy-gateway
sectionName: http
conditions:
- lastTransitionTime: null
message: 'APIKeyAuth: duplicated API key.'
reason: Invalid
status: "False"
type: Accepted
controllerName: gateway.envoyproxy.io/gatewayclass-controller
xdsIR:
envoy-gateway/gateway-1:
accessLog:
json:
- path: /dev/stdout
http:
- address: 0.0.0.0
hostnames:
- '*.envoyproxy.io'
isHTTP2: false
metadata:
kind: Gateway
name: gateway-1
namespace: envoy-gateway
sectionName: http
name: envoy-gateway/gateway-1/http
path:
escapedSlashesAction: UnescapeAndRedirect
mergeSlashes: true
port: 10080
routes:
- destination:
name: httproute/default/httproute-1/rule/0
settings:
- addressType: IP
endpoints:
- host: 7.7.7.7
port: 8080
name: httproute/default/httproute-1/rule/0/backend/0
protocol: HTTP
weight: 1
directResponse:
statusCode: 500
hostname: gateway.envoyproxy.io
isHTTP2: false
metadata:
kind: HTTPRoute
name: httproute-1
namespace: default
name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
pathMatch:
distinct: false
name: ""
prefix: /
security: {}
readyListener:
address: 0.0.0.0
ipFamily: IPv4
path: /ready
port: 19003
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ new features: |
bug fixes: |
Fix reference grant from SecurityPolicy to referenced remoteJWKS backend not respected.
Added validation for header values.
Added validation for duplicated API keys.

# Enhancements that improve performance.
performance improvements: |
Expand Down
12 changes: 12 additions & 0 deletions test/e2e/testdata/api-key-auth.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,15 @@ data:
# key2
client2: "a2V5Mg=="
---
apiVersion: v1
kind: Secret
metadata:
namespace: gateway-conformance-infra
name: api-key-auth-users-secret-2
data:
# key2 - duplicate client id should be ignored
client1: "a2V5Mg=="
---
Comment on lines +13 to +21
Copy link
Contributor Author

@gavinkflam gavinkflam May 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enhanced APIKeyAuth e2e test to cover duplicate client IDs. Only the first API key should be retained. For instance, in {client1: "key1"} + {client1: "key2"}, key2 is dropped.

This behavior is documented in the APIKeyAuth documentation.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
Expand Down Expand Up @@ -76,6 +85,7 @@ spec:
- headers: ["X-API-KEY"]
credentialRefs:
- name: "api-key-auth-users-secret-1"
- name: "api-key-auth-users-secret-2"
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
Expand All @@ -92,6 +102,7 @@ spec:
- cookies: ["X-API-KEY"]
credentialRefs:
- name: "api-key-auth-users-secret-1"
- name: "api-key-auth-users-secret-2"

---
apiVersion: gateway.envoyproxy.io/v1alpha1
Expand All @@ -109,3 +120,4 @@ spec:
- params: ["X-API-KEY"]
credentialRefs:
- name: "api-key-auth-users-secret-1"
- name: "api-key-auth-users-secret-2"
Loading