Function StateAuthorized

plugins/authproxy/authproxy.cc:622–669

Terminal state. Allow the original request to proceed.

// Terminal state. Allow the original request to proceed.
static TSEvent
StateAuthorized(AuthRequestContext *auth, void *)
{
  const AuthOptions *options = auth->options();

  AuthLogDebug("request authorized");

  // Since the original request might have authentication headers, we may
  // need to force ATS to ignore those in order to make it cacheable.
  if (options->force) {
    TSHttpTxnConfigIntSet(auth->txn, TS_CONFIG_HTTP_CACHE_IGNORE_AUTHENTICATION, 1);
  }

  if (!options->forward_header_prefix.empty()) {
    // Copy headers with configured prefix in the authentication response to the original request
    TSMLoc    field_loc;
    TSMLoc    next_field_loc;
    TSMBuffer request_bufp;
    TSMLoc    request_hdr;

    TSReleaseAssert(TSHttpTxnClientReqGet(auth->txn, &request_bufp, &request_hdr) == TS_SUCCESS);
    field_loc = TSMimeHdrFieldGet(auth->rheader.buffer, auth->rheader.header, 0);
    TSReleaseAssert(field_loc != TS_NULL_MLOC);

    while (field_loc) {
      int key_len = 0;
      int val_len = 0;

      char *key = const_cast<char *>(TSMimeHdrFieldNameGet(auth->rheader.buffer, auth->rheader.header, field_loc, &key_len));
      char *val =
        const_cast<char *>(TSMimeHdrFieldValueStringGet(auth->rheader.buffer, auth->rheader.header, field_loc, -1, &val_len));

      if (key && val && ContainsPrefix(string_view(key, key_len), options->forward_header_prefix)) {
        // Append the matched header key/val to the original request
        HttpSetMimeHeader(request_bufp, request_hdr, string_view(key, key_len), string_view(val, val_len));
      }

      // Validate the next header field
      next_field_loc = TSMimeHdrFieldNext(auth->rheader.buffer, auth->rheader.header, field_loc);
      TSHandleMLocRelease(auth->rheader.buffer, auth->rheader.header, field_loc);
      field_loc = next_field_loc;
    }
  }

  // Proceed with the modified request
  TSHttpTxnReenable(auth->txn, TS_EVENT_HTTP_CONTINUE);
  return TS_EVENT_CONTINUE;
}

// Return true if the given request was tagged by a remap rule as needing
// authorization.