Gateway proof of concept

Links go to the Envoy Gateway test routes of this cluster.

WAF

• block, clean request
  200 with the echo: the WAF lets a clean request through
• block, try the SQL injection
  403, the Blocked by the WAF page
• detect, try the SQL injection
  200 with the echo: detect mode only logs the match
• plain, no WAF
  200 with the echo
• crash, WAF socket nobody listens on
  500, WAF unreachable: request refused (fail closed)
• timeout, WAF given 1 ms
  504, WAF too slow: request refused (fail closed)
• WAF test page
  forms and ready-made attack links for block and detect

Auth

• web, OIDC login
  redirect to the Keycloak login, then the echo with Authorization and Cookie removed
• idp, Keycloak discovery document
  200 JSON
• api, API key or JWT
  401 without an x-api-key or Bearer header (a browser sends neither)
• api2, external authorization
  denied without a valid x-api-key (a browser sends none)

nginx versus Envoy

• nginx redirect Envoy redirect
  both answer 308 to https
• nginx rewrite Envoy rewrite
  both reach the backend as /api/traces
• nginx basic auth Envoy basic auth
  both answer 401 and ask for a login

Credentials

None are shown here. Keycloak user alice and the API clients: secret keycloak-test-credentials in namespace poc-idp. API keys: secret api-keys, basic auth: secrets basic-auth-nginx and basic-auth-eg, all in namespace gateway-web.