Lightning Talk: Access Control and URI Path Normalization
summary
Envoy’s default URL handling can let path-based access control be bypassed because different encodings and backend normalizations can map distinct request paths to the same resource. Practical specifics: enable path normalization (standard RFC 3986 steps), merge duplicate slashes, and consider reject percent-encoded slashes when backends would decode them. Best safety is matching Envoy normalization to the origin; Envoy is adding backend-matching normalization profiles, but heterogeneous meshes remain unresolved.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:44Basics of Request Proxying
- 3:01Path Normalization
- 7:26Key Takeaways
- 8:28Practical Suggestions
related talks
12mLightning Talk: Leveraging Envoy's New Filter Chain Matchers for Advanced TLS Rou...
05mLightning Talk: Speak Egress and Exit: A Look at Securing Traf...
28mAuthorization with Envoy
11mLightning Talk: Building a Scalable Multi-Protocol API Gateway with Envoy
40mHostSplit: Exploitable Antipatterns in Unicode Normalization
31mProxying HTTP/3 (QUIC) Using CONNECT-UDP with Envoy
27mEnvoy Gateway: An in-Depth Guide of Its Benefits, Use Ca...
10mOverview of Authentication and Authorization Features in Envoy