membphis commented on code in PR #13978: URL: https://github.com/apache/apisix/pull/13978#discussion_r4214315686
########## docs/en/latest/plugins/forward-auth.md: ########## @@ -42,9 +42,27 @@ The `forward-auth` Plugin supports the integration with an external authorizatio - `X-Forwarded-Proto`: scheme - `X-Forwarded-Method`: HTTP method - `X-Forwarded-Host`: host -- `X-Forwarded-Uri`: URI +- `X-Forwarded-Uri`: normalized URI, including the query string - `X-Forwarded-For`: source IP +:::note + +These headers describe the request as the client sent it. If the Route also rewrites the request with [proxy-rewrite](./proxy-rewrite.md), the Upstream service receives the rewritten scheme, method, host, and URI, while the headers above keep carrying the client values. Review Comment: P2 (non-blocking): This statement also covers `X-Forwarded-Method`, but `proxy-rewrite.method` calls `ngx.req.set_method` during `rewrite`, before `forward-auth` reads the current method during `access`. When that option is configured, the authorization service receives the rewritten method, not the client's original method. Consider noting this exception so authorization policies do not rely on the wrong interpretation. Whether to address it in this PR is up to you. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
