Skip to content

feat: rule.upstream support insecure_skip_verify #1197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

feat: rule.upstream support insecure_skip_verify #1197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6c1cff0
feat: rule.upstream support insecure_skip_verify
wei840222 Nov 13, 2024
5f0a78f
fix: RuleMigration tests
wei840222 Nov 19, 2024
ee7990b
Merge branch 'ory:master' into master
wei840222 Jul 30, 2025
8075aba
Merge branch 'ory:master' into master
wei840222 Oct 10, 2025
b3a892e
Merge branch 'ory:master' into master
wei840222 Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion proxy/proxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@

import (
"context"
"crypto/tls"
"io"
"net/http"
"net/http/httputil"
Expand Down Expand Up @@ -74,7 +75,9 @@
Header: rw.header,
}, nil
} else if err == nil {
res, err := http.DefaultTransport.RoundTrip(r)
tr := http.DefaultTransport.(*http.Transport).Clone()
tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: rl.Upstream.InsecureSkipVerify}

Check failure on line 79 in proxy/proxy.go

View workflow job for this annotation

GitHub Actions / Run tests and lints 

G402: TLS InsecureSkipVerify may be true. (gosec)
res, err := tr.RoundTrip(r)
if err != nil {
d.r.Logger().
WithError(errors.WithStack(err)).
Expand Down
3 changes: 3 additions & 0 deletions rule/rule.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,9 @@ type Rule struct {
}

type Upstream struct {
// InsecureSkipVerify, if true, skips TLS verification when forwarding the request to the upstream URL.
InsecureSkipVerify bool `json:"insecure_skip_verify"`

// PreserveHost, if false (the default), tells ORY Oathkeeper to set the upstream request's Host header to the
// hostname of the API's upstream's URL. Setting this flag to true instructs ORY Oathkeeper not to do so.
PreserveHost bool `json:"preserve_host"`
Expand Down
12 changes: 6 additions & 6 deletions rule/rule_migrator_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,25 +26,25 @@ func TestRuleMigration(t *testing.T) {
{
d: "should work with v0.19.0-beta.1",
in: `{}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1",
},
{
d: "should work with v0.19.0-beta.1+oryOS.12",
in: `{}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1+oryOS.12",
},
{
d: "should work with v0.19.0-beta.1",
in: `{"version":"v0.19.0-beta.1"}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1",
},
{
d: "should work with 0.19.0-beta.1",
in: `{"version":"0.19.0-beta.1"}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"preserve_host":false,"strip_path":"","url":""}}`,
out: `{"id":"","version":"v0.19.0-beta.1","description":"","match":null,"errors":null,"authenticators":null,"authorizer":{"handler":"","config":null},"mutators":null,"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}}`,
version: "v0.19.0-beta.1+oryOS.12",
},
{
Expand Down Expand Up @@ -80,7 +80,7 @@ func TestRuleMigration(t *testing.T) {
}
}
],
"upstream":{"preserve_host":false,"strip_path":"","url":""}
"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}
}`,
version: "v0.33.0-beta.1+oryOS.12",
},
Expand Down Expand Up @@ -112,7 +112,7 @@ func TestRuleMigration(t *testing.T) {
}
},
"mutators": null,
"upstream":{"preserve_host":false,"strip_path":"","url":""}
"upstream":{"insecure_skip_verify":false,"preserve_host":false,"strip_path":"","url":""}
}`,
version: "v0.37.0+oryOS.18",
},
Expand Down
Loading