Kent GruberandYichao Yang 5fbd93d724 Limit the number of parts allowed for auth token (#8122) ...

## What changed?

This PR aims to add a limit to the number of parts when splitting an
`Authorization` header `Bearer $token` values.

## Why?

This is useful for limiting potential abuses from maliciously crafted
header values.

## How did you test it?
- [x] built
- [x] run locally and tested manually
- [x] covered by existing tests
- [ ] added new unit test(s)
- [ ] added new functional test(s)

## Potential risks

I don't think there's any major risk here?

2025-08-20 15:00:31 -07:00

..

authorizer_mock.go

Switch to uber gomock (#6493)

2024-09-09 14:44:20 -07:00

authorizer.go

Add NexusEndpointName to authorizer CallTarget (#6007)

2024-05-28 15:26:28 -07:00

claim_mapper_mock.go

Switch to uber gomock (#6493)

2024-09-09 14:44:20 -07:00

claim_mapper.go

Import alignment (#6426)

2024-08-23 14:48:10 -06:00

default_authorizer_test.go

Switch to uber gomock (#6493)

2024-09-09 14:44:20 -07:00

default_authorizer.go

Add method metadata and use for default authorizer (#4794)

2023-08-28 11:25:40 -07:00

default_jwt_claim_mapper_test.go

Switch to uber gomock (#6493)

2024-09-09 14:44:20 -07:00

default_jwt_claim_mapper.go

Limit the number of parts allowed for auth token (#8122)

2025-08-20 15:00:31 -07:00

default_token_key_provider.go

Import alignment (#6426)

2024-08-23 14:48:10 -06:00

frontend_api.go

Import alignment (#6426)

2024-08-23 14:48:10 -06:00

interceptor_test.go

Switch to uber gomock (#6493)

2024-09-09 14:44:20 -07:00

interceptor.go

Import alignment (#6426)

2024-08-23 14:48:10 -06:00

noop_authorizer.go

Add feature flag to disable cross namespace commands (#1432)

2021-04-07 12:04:53 -07:00

roles_test.go

Authorization for JWT tokens (#986)

2020-11-17 15:05:56 -08:00

roles.go

Add an ExtraData field to Claims struct (#1429)

2021-04-02 16:23:06 -07:00

token_key_provider.go

Add RawTokenKeyProvider (#2420)

2022-01-31 16:44:02 -08:00