credentials, transport, grpc : add a call option to override the :authority header on a per-RPC basis #8068

eshitachandwani · 2025-02-06T06:50:16Z

Fixes: #5361

RELEASE NOTES:

Added a CallAuthority callOption that can be used to overwrite the http :authority header on per-RPC basis.

codecov · 2025-02-06T07:06:39Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.24%. Comparing base (0003b4f) to head (4efe178).
Report is 94 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8068      +/-   ##
==========================================
- Coverage   82.32%   82.24%   -0.08%     
==========================================
  Files         387      417      +30     
  Lines       39064    41385    +2321     
==========================================
+ Hits        32159    34037    +1878     
- Misses       5593     5926     +333     
- Partials     1312     1422     +110

Files with missing lines	Coverage Δ
credentials/credentials.go	`88.57% <ø> (+0.69%)`	⬆️
credentials/insecure/insecure.go	`83.33% <100.00%> (+1.51%)`	⬆️
credentials/tls.go	`90.50% <100.00%> (+3.92%)`	⬆️
internal/transport/http2_client.go	`92.36% <100.00%> (+0.66%)`	⬆️
internal/transport/transport.go	`91.56% <ø> (ø)`
rpc_util.go	`82.51% <100.00%> (+1.84%)`	⬆️
stream.go	`81.82% <100.00%> (+0.04%)`	⬆️

... and 140 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

purnesh42H

Overall lgtm. Just few minor comments. I think we can combine some individual into t-tests.

credentials/credentials.go

internal/transport/http2_client.go

rpc_util.go

credentials/credentials_ext_test.go

purnesh42H · 2025-02-07T07:08:32Z

Also, don't feel strongly but may be we can utilize the setup in tls_ext_test or move the tls tests to tls_ext_test.go

credentials/insecure/insecure.go

credentials/tls.go

credentials/credentials.go

credentials/tls.go

rpc_util.go

credentials/credentials_ext_test.go

purnesh42H · 2025-04-22T02:54:20Z

Added a CallAuthority callOption that can be used to overwrite the http :authority header on per-RPC basis.
Introduces an option AuthorityValidator interface which needs to be implemented by credentials that want to allow authority overwrite.
Adds implementations of AuthorityValidator interface for Insecure and TLS credentials.

these aren't the release notes. Are they? Release notes needs to make sense to the user which is the new call option we are introducing. So it can be something close to what you have in the PR title. The above bullets can just be moved to PR description.

credentials/credentials_ext_test.go

credentials/tls.go

credentials/credentials_ext_test.go

purnesh42H · 2025-04-22T03:27:12Z

rpc_util.go

 }
 func (o MaxRecvMsgSizeCallOption) after(*callInfo, *csAttempt) {}

+// CallAuthority creates a CallOption that sets the HTTP/2 :authority header of


I think we should mention here that if this dial option is used, the credentials in use must implement AuthorityValidator

credentials/credentials_ext_test.go

credentials/credentials.go

credentials/credentials_ext_test.go

credentials/insecure/insecure.go

credentials/tls.go

easwars · 2025-04-22T21:14:51Z

internal/transport/http2_client.go

+	if callHdr.Authority != "" {
+		auth, ok := t.authInfo.(credentials.AuthorityValidator)
+		if !ok {
+			return nil, &NewStreamError{Err: status.Error(codes.Unavailable, fmt.Sprintf("credentials type %s does not implement the AuthorityValidator interface, but authority override specified with CallAuthority call option", t.authInfo.AuthType()))}


Same here too. Use status.Errorf.

And use %q formatting directive for the credentials type.

easwars · 2025-04-22T21:15:47Z

internal/transport/http2_client.go

+			return nil, &NewStreamError{Err: status.Error(codes.Unavailable, fmt.Sprintf("credentials type %s does not implement the AuthorityValidator interface, but authority override specified with CallAuthority call option", t.authInfo.AuthType()))}
+		}
+		if err := auth.ValidateAuthority(callHdr.Authority); err != nil {
+			return nil, &NewStreamError{Err: status.Error(codes.Unavailable, fmt.Sprintf("failed to validate authority %s : %s", callHdr.Authority, err))}


Both the above comments here too. And use %v for err.

easwars

LGTM modulo minor nits in this last pass

credentials/credentials_ext_test.go

easwars · 2025-04-29T20:44:21Z

credentials/credentials_ext_test.go

+	if authority == v.validAuthority {
+		return nil
+	}
+	return fmt.Errorf("invalid authority")


Nit: capture the invalid authority value in the returned error

credentials/credentials_ext_test.go

credentials/credentials.go

…hority header on a per-RPC basis (grpc#8068)

eshitachandwani and others added 4 commits January 24, 2025 10:52

regenrate protos

6840baf

revert

11d96c1

authority overwrite

d5b5af1

Merge branch 'grpc:master' into auth_override

34175aa

eshitachandwani added Type: Feature New features or improvements in behavior Area: Auth Includes regular credentials API and implementation. Also includes advancedtls, authz, rbac etc. labels Feb 6, 2025

eshitachandwani added this to the 1.71 Release milestone Feb 6, 2025

eshitachandwani added 2 commits February 6, 2025 12:25

update callInfo

4791ac7

update callInfo

ac318de

eshitachandwani requested a review from purnesh42H February 6, 2025 07:09

eshitachandwani assigned purnesh42H Feb 6, 2025

purnesh42H reviewed Feb 7, 2025

View reviewed changes

purnesh42H assigned eshitachandwani and unassigned purnesh42H Feb 7, 2025

eshitachandwani added 2 commits February 10, 2025 14:34

efn

d1ea438

address comments

72d132a

eshitachandwani requested a review from easwars February 11, 2025 07:19

eshitachandwani assigned easwars Feb 11, 2025

Merge branch 'grpc:master' into auth_override

b1583a6

easwars reviewed Feb 13, 2025

View reviewed changes

credentials/insecure/insecure.go Outdated Show resolved Hide resolved

credentials/tls.go Outdated Show resolved Hide resolved

credentials/credentials.go Outdated Show resolved Hide resolved

credentials/credentials.go Show resolved Hide resolved

easwars reviewed Feb 14, 2025

View reviewed changes

easwars removed their assignment Feb 14, 2025

arjan-bal modified the milestones: 1.71 Release, 1.72 Release Feb 19, 2025

eshitachandwani modified the milestones: 1.72 Release, 1.73 Release Apr 3, 2025

address comments

74e7a8a

eshitachandwani requested a review from easwars April 14, 2025 19:23

eshitachandwani added 4 commits April 15, 2025 00:56

address comments

9b81586

vet

515fad1

refactor

9e48a2a

refactor

c5aac00

purnesh42H reviewed Apr 22, 2025

View reviewed changes

credentials/credentials_ext_test.go Outdated Show resolved Hide resolved

purnesh42H assigned eshitachandwani and unassigned purnesh42H Apr 22, 2025

easwars reviewed Apr 22, 2025

View reviewed changes

easwars assigned eshitachandwani and unassigned easwars and eshitachandwani Apr 22, 2025

eshitachandwani added 3 commits April 28, 2025 14:26

refactor test

e3e6aab

minor changes

24b408e

fmt

9777548

eshitachandwani requested review from easwars and purnesh42H April 28, 2025 16:02

eshitachandwani assigned easwars and purnesh42H and unassigned eshitachandwani Apr 28, 2025

easwars approved these changes Apr 29, 2025

View reviewed changes

easwars assigned eshitachandwani and unassigned easwars and purnesh42H Apr 29, 2025

eshitachandwani added 2 commits April 30, 2025 14:23

final comments

b9e93d0

final comments

4efe178

eshitachandwani merged commit 080f956 into grpc:master Apr 30, 2025
23 of 24 checks passed

purnesh42H pushed a commit to purnesh42H/grpc-go that referenced this pull request May 4, 2025

credentials, transport, grpc : add a call option to override the :aut…

863a463

…hority header on a per-RPC basis (grpc#8068)

vinothkumarr227 pushed a commit to vinothkumarr227/grpc-go that referenced this pull request May 26, 2025

credentials, transport, grpc : add a call option to override the :aut…

699cb70

…hority header on a per-RPC basis (grpc#8068)

credentials, transport, grpc : add a call option to override the :authority header on a per-RPC basis #8068

credentials, transport, grpc : add a call option to override the :authority header on a per-RPC basis #8068

Uh oh!

Conversation

eshitachandwani commented Feb 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

purnesh42H left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

purnesh42H commented Feb 7, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

purnesh42H commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

easwars left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

eshitachandwani commented Feb 6, 2025 •

edited

Loading

codecov bot commented Feb 6, 2025 •

edited

Loading

purnesh42H commented Apr 22, 2025 •

edited

Loading