Feature Request: Limit user info

We use this config for several ingress configurations:

# traefik ingress
ingress.kubernetes.io/auth-type: forward
ingress.kubernetes.io/auth-url: "https://eas.example.com/verify?config_token=CONFIG_TOKEN_HERE"
ingress.kubernetes.io/auth-response-headers: X-Userinfo, X-Id-Token, X-Access-Token, Authorization

Recently we got this kind of error messages from nginx and apache servers:

400 Bad Request
Request Header Or Cookie Too Large
nginx/1.17.7

It turns out that users which belong to several github organisations have a lot of data in the user info part. From my point of view it would be great to get a limited Info block which would could the loginname, userid, email address, mfa,

I checked the headers and the userinfo part alone is about 4k bytes for my user…

[Subreptivus]

Alternatively, if your backing services don’t need the header data just remove them from the allowed headers in your ingress configuration.

It’s not always easy to do. For example in Istio/Envoy it’s so called ext_authz plugin, and you don’t have much control of headers in “inner” cycle (envoy <-> ext_authz service), yet you do have control over “outer” cycle (clien t<-> envoy <-> ext_authz service <-> envoy <-> destination). So you have to strip unneeded headers before it hits destination, which you can easily forget to do. And you can’t decline cookie header (which is almost always the source of the problems with header size limits) for entering your ingress, because eas is actually using it.

So I would like to see this feature added as well.

BTW, eas itself suffers from the same workflow. If you hit eas with big header (for example cookie > 4Kb) it will return you HTTP error 400. Because node has default limit for header size of 4Kb. But it could be easily fixed with Environment Variable = NODE_OPTIONS=--max-http-header-size=61440

[travisghansen]

https://github.com/travisghansen/external-auth-server/commit/dcf8f24fccaa7cf17cfdd7dc6d005b7e54636c1b