Closed Trojan295 closed 6 years ago
To be accurate, X-Userinfo is populated with the payload of the user info, not the payload of the ID token.
Nevertheless, agree that it would be a useful enhancement to be able to pass the ID token for cases when the upstream service is in or behind an insecure network and the header might be compromised.
We put user info into headers, in X-Userinfo. But in headers there is also access token, in Authorization. And using access token you can request user info from userinfo_endpoint.
FIxed in version 1.0.3.
Hello,
The plugin is injecting only the payload in the ID token into the request. On the upstream side, there is no option to validate the data in the 'X-Userinfo' header (an adversary could modify this in fly).
Adding the whole ID token into the header (in base64) would solve this problem.
Br, Damian