Impact

Routes expected to be protected by external authorization are served without enforcement. This occurs when the virtualhost defines its own authorization server with authPolicy.disabled: true and individual routes attempt to opt back in with authPolicy.disabled: false.

Details

Contour supports defining external authorization globally (via globalExtAuth in the Contour config file), allowing individual virtualhosts to opt out by setting .spec.virtualhost.authorization.authPolicy.disabled: true. Individual routes can then opt back in by setting .spec.routes[].authPolicy.disabled: false. This works correctly with global authorization.

However, if instead of using global authorization, a user defines the authorization server directly on the virtualhost using .spec.virtualhost.authorization.extensionRef and simultaneously disables it .spec.virtualhost.authorization.authPolicy.disabled: true, the route-level opt-in silently fails, and routes with authPolicy.disabled: false are served without authorization enforcement.

The following example shows an affected HTTPProxy:

kind: HTTPProxy
metadata:
  name: example
spec:
  virtualhost:
    fqdn: example.projectcontour.io
    tls:
      secretName: example-tls
    authorization:      # Define authorization server, but disable it.
      extensionRef:
        name: extension
        namespace: auth
      authPolicy:
        disabled: true
  routes:
    - conditions:
      - prefix: /protected
      services:
      - name: app-server
        port: 80
      authPolicy:
        disabled: false  # Opt-in silently fails and /protected is served without authorization
    - conditions:
      - prefix: /public
      services:
      - name: app-server
        port: 80

To list if you have HTTPProxies with this configuration run

kubectl get httpproxy -A -o json | jq -r '
  .items[]
  | select(.spec.virtualhost.authorization.extensionRef)
  | select(.spec.virtualhost.authorization.authPolicy.disabled)
  | select(.spec.routes[]?.authPolicy.disabled == false)
  | "\(.metadata.namespace)/\(.metadata.name)"
'

Note: If you also have globalExtAuth configured, the HTTPProxies are still protected, but by the global authz server, not the one defined as disabled in the virtualhost's extensionRef.

Patches

Users should upgrade to v1.33.6.

Workarounds

Set .spec.virtualhost.authorization.authPolicy.disabled: false (which is the default if omitted) so that authorization is active by default. Then explicitly disable it only on public routes by setting .spec.routes[].authPolicy.disabled: true.

References

• https://projectcontour.io/docs/main/config/client-authorization/
• https://projectcontour.io/docs/main/guides/external-authorization/