fix: fix authentication bypass for capsule-proxy

- fix authentication bypass for capsule-proxy with leading token Signed-off-by: slimm609 <[email protected]>
projectcapsule · Nov 23, 2023 · 472404f · 472404f
1 parent 079600f
commit 472404f
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/internal/request/http.go b/internal/request/http.go
@@ -114,6 +114,10 @@ func (h http) processBearerToken() (username string, groups []string, err error)
 		return "", nil, fmt.Errorf("cannot create TokenReview")
 	}
 
+	if !tr.Status.Authenticated {
+		return "", nil, fmt.Errorf("cannot verify the token due to error")
+	}
+
 	if statusErr := tr.Status.Error; len(statusErr) > 0 {
 		return "", nil, fmt.Errorf("cannot verify the token due to error")
 	}