search

edgexfoundry / security-api-gateway

Owner: Security WG
Apache License 2.0
11 stars 10 forks source link

The Host Header should be configurable when generating OAuth tokens #40

Closed anonymouse64 closed 5 years ago

anonymouse64 commented 5 years ago

Currently, the Host header is always set to edgex, which will fail if the user is attempting to create the OAuth token over HTTPS and uses a SNI/hostname setting other than edgex, as the certificate validation will fail. This setting should be configurable.

tingyuz commented 5 years ago

will switch from hardcode to snis section of [secretservice] section in the configuration file. This will be addressed in Delhi dot release.

tingyuz commented 5 years ago

addressed in PR #47.

tingyuz commented 5 years ago

I will propose to remove host header as it is not gaining any benefit. Besides based on my testing on KONG 1.0.3 it seems there is a bug with combination of custom header and JWT/OAuth2 auth plugin.

tingyuz commented 5 years ago

close this issue per my comments above.