{"action":"created","issue":{"url":"https://api.github.com/repos/Kong/kong/issues/4007","repository_url":"https://api.github.com/repos/Kong/kong","labels_url":"https://api.github.com/repos/Kong/kong/issues/4007/labels{/name}","comments_url":"https://api.github.com/repos/Kong/kong/issues/4007/comments","events_url":"https://api.github.com/repos/Kong/kong/issues/4007/events","html_url":"https://github.com/Kong/kong/issues/4007","id":383309576,"node_id":"MDU6SXNzdWUzODMzMDk1NzY=","number":4007,"title":"OAuth2 Protected Proxy yeilds HTTP 500 error","user":{"login":"jeremyjpj0916","id":31913027,"node_id":"MDQ6VXNlcjMxOTEzMDI3","avatar_url":"https://avatars1.githubusercontent.com/u/31913027?v=4","gravatar_id":"","url":"https://api.github.com/users/jeremyjpj0916","html_url":"https://github.com/jeremyjpj0916","followers_url":"https://api.github.com/users/jeremyjpj0916/followers","following_url":"https://api.github.com/users/jeremyjpj0916/following{/other_user}","gists_url":"https://api.github.com/users/jeremyjpj0916/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremyjpj0916/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremyjpj0916/subscriptions","organizations_url":"https://api.github.com/users/jeremyjpj0916/orgs","repos_url":"https://api.github.com/users/jeremyjpj0916/repos","events_url":"https://api.github.com/users/jeremyjpj0916/events{/privacy}","received_events_url":"https://api.github.com/users/jeremyjpj0916/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-11-21T22:12:11Z","updated_at":"2018-11-22T16:53:24Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"### Summary\r\n\r\nWe have a proxy protected with ACL and OAUTH2.0, recently a consumer came to us with a specific proxy path on their wildcarded proxy returning HTTP 500's. Our logs indicate it stopped @ the gateway and never proxied. Checking Kong logs I see this error.\r\n\r\n```\r\n2018/11/21 13:54:58 [error] 84#0: *10614388 lua coroutine: runtime error: /usr/local/share/lua/5.1/kong/tools/utils.lua:430: bad argument #1 to 'pairs' (table expected, got number)\r\nstack traceback:\r\ncoroutine 0:\r\n               [C]: in function 'pairs'\r\n               /usr/local/share/lua/5.1/kong/tools/utils.lua:430: in function 'retrieve_parameters'\r\n               /usr/local/share/lua/5.1/kong/plugins/oauth2/access.lua:453: in function 'parse_access_token'\r\n               /usr/local/share/lua/5.1/kong/plugins/oauth2/access.lua:531: in function 'do_authentication'\r\n               /usr/local/share/lua/5.1/kong/plugins/oauth2/access.lua:603: in function 'execute'\r\n               /usr/local/share/lua/5.1/kong/plugins/oauth2/handler.lua:12: in function </usr/local/share/lua/5.1/kong/plugins/oauth2/handler.lua:10>\r\ncoroutine 1:\r\n               [C]: in function 'resume'\r\n               coroutine.wrap:21: in function <coroutine.wrap:21>\r\n               /usr/local/share/lua/5.1/kong/init.lua:468: in function 'access'\r\naccess_by_lua(nginx.conf:119):2: in function <access_by_lua(nginx.conf:119):1>, client: 10.***.*.***, server: kong, request: \"POST /api/test2/provider/v1/bill/Service HTTP/1.1\", host: \"gateway.company.com\"\r\n```\r\n\r\nOAuth2.0 Plugin on route config(pretty standard):\r\n```\r\n{\r\n  \"created_at\": 1537827592725,\r\n  \"config\": {\r\n    \"refresh_token_ttl\": 1209600,\r\n    \"token_expiration\": 7200,\r\n    \"mandatory_scope\": false,\r\n    \"accept_http_if_already_terminated\": false,\r\n    \"hide_credentials\": false,\r\n    \"enable_implicit_grant\": false,\r\n    \"global_credentials\": true,\r\n    \"enable_client_credentials\": true,\r\n    \"enable_password_grant\": false,\r\n    \"anonymous\": \"\",\r\n    \"enable_authorization_code\": false,\r\n    \"provision_key\": \"function\",\r\n    \"auth_header_name\": \"authorization\"\r\n  },\r\n  \"id\": \"91b369b6-fb78-4562-9138-a20fc0814b5a\",\r\n  \"name\": \"oauth2\",\r\n  \"route_id\": \"cc488204-fcf6-4826-b30e-3bbe8bdaee3f\",\r\n  \"enabled\": true\r\n}\r\n```\r\n\r\nMy initial analysis reveals this:\r\n\r\n1. They could not be passing the token as Authorization: Bearer <token> header otherwise the first catch in the parse_access_token would be hit and handled properly. So it goes to retrieve_parameters call which checks the http body and the uri for query parameters.\r\n\r\nMy guess is that at this spot: https://github.com/Kong/kong/blob/master/kong/plugins/oauth2/access.lua#L113 the https://github.com/Kong/kong/blob/master/kong/tools/utils.lua#L420 , table merge call fails to handle certain edge cases based on the uri_args that were collected 🔥  .\r\n\r\n### Steps To Reproduce\r\n\r\n1. One way to reproduce is in the HTTP Body just post a raw numeric string with nothing else. Leave off the Authorization: Bearer {token} if you are running latest Kong master branch with my PR that looks for header first before body. If you run the official 14.1 Kong release it looks for body before caring about token in header so error will occur even if you send proper token in header.\r\n\r\n### Additional Details & Logs\r\n- Kong version 14.1"},"comment":{"url":"https://api.github.com/repos/Kong/kong/issues/comments/441083873","html_url":"https://github.com/Kong/kong/issues/4007#issuecomment-441083873","issue_url":"https://api.github.com/repos/Kong/kong/issues/4007","id":441083873,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTA4Mzg3Mw==","user":{"login":"Tieske","id":1077043,"node_id":"MDQ6VXNlcjEwNzcwNDM=","avatar_url":"https://avatars1.githubusercontent.com/u/1077043?v=4","gravatar_id":"","url":"https://api.github.com/users/Tieske","html_url":"https://github.com/Tieske","followers_url":"https://api.github.com/users/Tieske/followers","following_url":"https://api.github.com/users/Tieske/following{/other_user}","gists_url":"https://api.github.com/users/Tieske/gists{/gist_id}","starred_url":"https://api.github.com/users/Tieske/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tieske/subscriptions","organizations_url":"https://api.github.com/users/Tieske/orgs","repos_url":"https://api.github.com/users/Tieske/repos","events_url":"https://api.github.com/users/Tieske/events{/privacy}","received_events_url":"https://api.github.com/users/Tieske/received_events","type":"User","site_admin":false},"created_at":"2018-11-22T16:53:24Z","updated_at":"2018-11-22T16:53:24Z","author_association":"MEMBER","body":"> Hopefully this bug does not pop up and bite too many other plugins/parts of the code base.\r\n\r\nfierce internal debate going on 😄 "}}
{"actor":{"display_login":"Tieske"}}