Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merging to release-5.3.5: [TT-13087] Adjust example gateway config, to have match preficing explicit by default (#6564) #6571

Conversation

buger
Copy link
Member

@buger buger commented Sep 23, 2024

User description

TT-13087 Adjust example gateway config, to have match preficing explicit by default (#6564)

User description

Description

TT-13087 Adjust example gateway config, to have match preficing explicit
by default

Motivation and Context

Would be advised that Gateway users, would have by default explicit path
matching settings enabled by default, as the wildcard behaviour of the
path matching, can be challenging at times to configure properly.

How This Has Been Tested

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing
    functionality to change)
  • Refactoring or add test (improvements in base code or adds test
    coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning
    why it's required
  • I would like a code coverage CI quality gate exception and have
    explained why

PR Type

enhancement, configuration changes


Description

  • Added new configuration options in tyk.conf.example to enable strict
    routing and explicit path matching by default.
  • The changes aim to improve the default behavior for gateway users by
    making path matching settings explicit.

Changes walkthrough 📝

Relevant files
Configuration changes
tyk.conf.example
Add explicit path matching options to example gateway config

tyk.conf.example

  • Added http_server_options section.
  • Enabled enable_strict_routes.
  • Enabled enable_path_prefix_matching.
  • Enabled enable_path_suffix_matching.
  • +5/-0     

    💡 PR-Agent usage: Comment /help "your question" on any pull
    request to receive relevant information


    PR Type

    enhancement, configuration changes


    Description

    • Added new configuration options in tyk.conf.example to enable strict routing and explicit path matching by default.
    • Introduced http_server_options with enable_strict_routes, enable_path_prefix_matching, and enable_path_suffix_matching set to true.
    • These changes aim to improve the default behavior of path matching, making it more explicit and reducing configuration challenges.

    Changes walkthrough 📝

    Relevant files
    Configuration changes
    tyk.conf.example
    Add explicit path matching options to example gateway config

    tyk.conf.example

  • Added http_server_options section.
  • Enabled enable_strict_routes.
  • Enabled enable_path_prefix_matching.
  • Enabled enable_path_suffix_matching.
  • +5/-0     

    💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

    …licit by default (#6564)
    
    ### **User description**
    ## Description
    TT-13087 Adjust example gateway config, to have match preficing explicit
    by default
    
    ## Motivation and Context
    Would be advised that Gateway users, would have by default explicit path
    matching settings enabled by default, as the wildcard behaviour of the
    path matching, can be challenging at times to configure properly.
    
    ## How This Has Been Tested
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    ## Types of changes
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [x] Bug fix (non-breaking change which fixes an issue)
    - [x] New feature (non-breaking change which adds functionality)
    - [x] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [x] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    ## Checklist
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [x] I ensured that the documentation is up to date
    - [x] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [x] I would like a code coverage CI quality gate exception and have
    explained why
    
    
    ___
    
    ### **PR Type**
    enhancement, configuration changes
    
    
    ___
    
    ### **Description**
    - Added new configuration options in `tyk.conf.example` to enable strict
    routing and explicit path matching by default.
    - The changes aim to improve the default behavior for gateway users by
    making path matching settings explicit.
    
    
    ___
    
    
    
    ### **Changes walkthrough** 📝
    <table><thead><tr><th></th><th align="left">Relevant
    files</th></tr></thead><tbody><tr><td><strong>Configuration
    changes</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>tyk.conf.example</strong><dd><code>Add explicit path
    matching options to example gateway config</code></dd></summary>
    <hr>
    
    tyk.conf.example
    
    <li>Added <code>http_server_options</code> section.<br> <li> Enabled
    <code>enable_strict_routes</code>.<br> <li> Enabled
    <code>enable_path_prefix_matching</code>.<br> <li> Enabled
    <code>enable_path_suffix_matching</code>.
    
    
    </details>
    
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6564/files#diff-a6736b4b3cda1ee503675d7b725f6138f4eb83d7145f3afecf6087d219f2b23a">+5/-0</a>&nbsp;
    &nbsp; &nbsp; </td>
    
    </tr>                    
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > 💡 **PR-Agent usage**: Comment `/help "your question"` on any pull
    request to receive relevant information
    
    (cherry picked from commit d98cc03)
    Copy link
    Contributor

    API Changes

    no api changes detected

    Copy link
    Contributor

    PR Reviewer Guide 🔍

    ⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
    🧪 No relevant tests
    🔒 No security concerns identified
    ⚡ Key issues to review

    Configuration Change
    The new configuration options added for strict routing and explicit path matching need to be validated to ensure they do not disrupt existing setups. It's crucial to verify that these settings are compatible with all current deployments and do not introduce breaking changes unexpectedly.

    Copy link
    Contributor

    github-actions bot commented Sep 23, 2024

    PR Code Suggestions ✨

    CategorySuggestion                                                                                                                                    Score
    Security
    Change the default setting of enable_path_suffix_matching to false to prevent potential misrouting

    Consider setting "enable_path_suffix_matching" to false by default to avoid
    unintended route matches unless explicitly required by the user. This can help in
    preventing unexpected behavior in route matching which might lead to security
    concerns or misrouting.

    tyk.conf.example [36]

     "http_server_options": {
       "enable_strict_routes": true,
       "enable_path_prefix_matching": true,
    -  "enable_path_suffix_matching": true
    +  "enable_path_suffix_matching": false
     }
     
    Suggestion importance[1-10]: 8

    Why: The suggestion addresses a potential security concern by preventing unintended route matches, which could lead to misrouting or unexpected behavior. Setting enable_path_suffix_matching to false by default is a prudent measure to enhance security.

    8

    Copy link

    sonarcloud bot commented Sep 23, 2024

    @lghiur lghiur merged commit 054c5da into release-5.3.5 Sep 24, 2024
    30 of 33 checks passed
    @lghiur lghiur deleted the merge/release-5.3.5/d98cc036e3d7afde6d9292d42520b301481dc5f3 branch September 24, 2024 12:53
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Projects
    None yet
    Development

    Successfully merging this pull request may close these issues.

    2 participants