Oath Keeper pass first header form hydrator endpoint

[alan994]

Hi Ory team,

I'm trying to use the hydrator mutator. In #942 I had a problem where the hydrator endpoint returned headers all in lower case and then Oath Keeper didn't pass values to the upstream service. That is solved and it is working, but I have a problem if I return an array for some header.
For example, I return something like this from my hydrator endpoint

{
  ... other properties ...
  "header": {
      "X-Tl-User-Id": [
          "alan994"
      ],
      "X-Tl-Company-Id": [
          "aj-solutions",
          "talentlyft"
      ]
  }
}

When I look at logs in my upstream service I get only the first item in the X-Tl-Company-Id header.

[06:53:13 INF] Executing endpoint 'HTTP: GET /secure'
[06:53:13 INF] Header arrived: Accept - ["application/json, text/plain, */*"]
[06:53:13 INF] Header arrived: Host - ["api"]
[06:53:13 INF] Header arrived: User-Agent - ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"]
[06:53:13 INF] Header arrived: Accept-Encoding - ["gzip, deflate, br"]
[06:53:13 INF] Header arrived: Accept-Language - ["en-US,en;q=0.9,hr;q=0.8"]
[06:53:13 INF] Header arrived: Cache-Control - ["no-cache"]
[06:53:13 INF] Header arrived: Cookie - ["ory_kratos_continuity=MTY0OTQxMTk1OHxEdi1CQkFFQ180SUFBUkFCRUFBQUJQLUNBQUE9fJu6js9VR42JjDnGEL6VC_vGlxENGrajtVVAd-mRqG57; csrf_token_806060ca5bf70dff3caa0e5c860002aade9d470a5a4dce73bcfa7ba10778f481=bpLkMckuQogbhkElnpnxZPk9rnoQIpdO8XriNOfmDqc=; ory_kratos_session=MTY1MDUyMjg0M3x4Q0xMMFVhbW1MZTdZaUFhSTlNaDBucnhhbUNVM01XUXF1bkR4cUZjT2dLa1phcEZnM0RwZDBraTBsdDRHeVpMRHV2OHA3bE5maFJvNUpZNDNoTGcwdDB2OUZzQWlMMmNzN2tLODRSbnNWdDlMZVhoVDVxTEZqUW5ZQW8xYXNvdFktNzdEQmsxN2c9PXzYbqlgML-saJhgz7aT7F1kgQbkBj1g8obO9HNCUtmohw=="]
[06:53:13 INF] Header arrived: Origin - ["http://127.0.0.1:4200"]
[06:53:13 INF] Header arrived: Pragma - ["no-cache"]
[06:53:13 INF] Header arrived: Referer - ["http://127.0.0.1:4200/"]
[06:53:13 INF] Header arrived: Sec-Ch-Ua - ["\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"100\", \"Google Chrome\";v=\"100\""]
[06:53:13 INF] Header arrived: Sec-Ch-Ua-Mobile - ["?0"]
[06:53:13 INF] Header arrived: Sec-Ch-Ua-Platform - ["\"Windows\""]
[06:53:13 INF] Header arrived: Sec-Fetch-Dest - ["empty"]
[06:53:13 INF] Header arrived: Sec-Fetch-Mode - ["cors"]
[06:53:13 INF] Header arrived: Sec-Fetch-Site - ["same-site"]
[06:53:13 INF] Header arrived: X-Forwarded-For - ["172.18.0.1"]
[06:53:13 INF] Header arrived: X-Tl-Company-Id - ["aj-solutions"]
[06:53:13 INF] Header arrived: X-Tl-User-Id - ["alan994"]

My example code is the same as in the previous discussion. You can find it here.

FYI: @vinckr @gen1us2k

[gen1us2k]

Hello. You can pass an array as a string with some delimiter char as the way CSV file does. Then, in the server-side code, just use some string split function to get back the array. If the string contains the delimiter character, escape them.

[gen1us2k]

I'll do a small research on the topic. I'm not sure that arrays are supported by HTTP specifications.

[alan994]

In my opinion Oath Keeper should loop over an array returned by the hydrator endpoint and for each one add header in the upstream request. I think that HTTP requests with multiple same headers are perfectly valid.

[gen1us2k]

Multiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to combine the multiple header fields into one "field-name: field-value" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. The order in which header fields with the same field-name are received is therefore significant to the interpretation of the combined field value, and thus a proxy MUST NOT change the order of these field values when a message is forwarded.
this is from RFC2616.

The right way is to pass headers IMO

X-Tl-Company-Id: aj-solutions, talentlyft

I think that the workaround you're implementing is the best solution for that case.

[aeneasr]

I'll do a small research on the topic. I'm not sure that arrays are supported by HTTP specifications.

You're right, it appears that sending multiple headers as part of an HTTP request is not considered standards conform. However, it's not clear-cut as there are several RFCs kind-of contracticting each other plus a few exceptions. One of those exceptions, is Set-Cookie - those however are usually sent in the response, not the request! So yes, this should be sent comma separated!

[alan994]

Ok, I didn't know that. Thanks!
Maybee then consider changing expected structure of hydrator endpoint response? Right now it is a string array. If Oath Keeper will not concatenate the array itself, then in my opinion there is no need for a string array, a simple string is good enough.

Either way, thanks for the discussion and help. Keep up the good work 👍