{"action":"created","issue":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/2514","repository_url":"https://api.github.com/repos/envoyproxy/envoy","labels_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2514/labels{/name}","comments_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2514/comments","events_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2514/events","html_url":"https://github.com/envoyproxy/envoy/issues/2514","id":293758371,"number":2514,"title":"Add a HTTP filter for JWT verification","user":{"login":"qiwzhang","id":11790727,"avatar_url":"https://avatars0.githubusercontent.com/u/11790727?v=4","gravatar_id":"","url":"https://api.github.com/users/qiwzhang","html_url":"https://github.com/qiwzhang","followers_url":"https://api.github.com/users/qiwzhang/followers","following_url":"https://api.github.com/users/qiwzhang/following{/other_user}","gists_url":"https://api.github.com/users/qiwzhang/gists{/gist_id}","starred_url":"https://api.github.com/users/qiwzhang/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qiwzhang/subscriptions","organizations_url":"https://api.github.com/users/qiwzhang/orgs","repos_url":"https://api.github.com/users/qiwzhang/repos","events_url":"https://api.github.com/users/qiwzhang/events{/privacy}","received_events_url":"https://api.github.com/users/qiwzhang/received_events","type":"User","site_admin":false},"labels":[{"id":421403909,"url":"https://api.github.com/repos/envoyproxy/envoy/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"lizan","id":1016047,"avatar_url":"https://avatars1.githubusercontent.com/u/1016047?v=4","gravatar_id":"","url":"https://api.github.com/users/lizan","html_url":"https://github.com/lizan","followers_url":"https://api.github.com/users/lizan/followers","following_url":"https://api.github.com/users/lizan/following{/other_user}","gists_url":"https://api.github.com/users/lizan/gists{/gist_id}","starred_url":"https://api.github.com/users/lizan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lizan/subscriptions","organizations_url":"https://api.github.com/users/lizan/orgs","repos_url":"https://api.github.com/users/lizan/repos","events_url":"https://api.github.com/users/lizan/events{/privacy}","received_events_url":"https://api.github.com/users/lizan/received_events","type":"User","site_admin":false},"assignees":[{"login":"lizan","id":1016047,"avatar_url":"https://avatars1.githubusercontent.com/u/1016047?v=4","gravatar_id":"","url":"https://api.github.com/users/lizan","html_url":"https://github.com/lizan","followers_url":"https://api.github.com/users/lizan/followers","following_url":"https://api.github.com/users/lizan/following{/other_user}","gists_url":"https://api.github.com/users/lizan/gists{/gist_id}","starred_url":"https://api.github.com/users/lizan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lizan/subscriptions","organizations_url":"https://api.github.com/users/lizan/orgs","repos_url":"https://api.github.com/users/lizan/repos","events_url":"https://api.github.com/users/lizan/events{/privacy}","received_events_url":"https://api.github.com/users/lizan/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2018-02-02T03:05:10Z","updated_at":"2018-05-11T18:03:05Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"*Title*: Add a HTTP filter for JWT verification\r\n\r\n*Description*:\r\nJWT verification is important for many services.  This filter will allow Envoy proxy to verify the JWT token by fetching the remote pubkey and pass the verified JWT payload to the services for further authorization.\r\n\r\nIstio has this filter here: https://github.com/istio/proxy/tree/master/src/envoy/http/jwt_auth\r\nThis issue wants to upstream the filter to Envoy.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/envoyproxy/envoy/issues/comments/388440520","html_url":"https://github.com/envoyproxy/envoy/issues/2514#issuecomment-388440520","issue_url":"https://api.github.com/repos/envoyproxy/envoy/issues/2514","id":388440520,"user":{"login":"llchan","id":51099,"avatar_url":"https://avatars2.githubusercontent.com/u/51099?v=4","gravatar_id":"","url":"https://api.github.com/users/llchan","html_url":"https://github.com/llchan","followers_url":"https://api.github.com/users/llchan/followers","following_url":"https://api.github.com/users/llchan/following{/other_user}","gists_url":"https://api.github.com/users/llchan/gists{/gist_id}","starred_url":"https://api.github.com/users/llchan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/llchan/subscriptions","organizations_url":"https://api.github.com/users/llchan/orgs","repos_url":"https://api.github.com/users/llchan/repos","events_url":"https://api.github.com/users/llchan/events{/privacy}","received_events_url":"https://api.github.com/users/llchan/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T18:03:05Z","updated_at":"2018-05-11T18:03:05Z","author_association":"NONE","body":"That would in theory work, but the config would be very verbose compared to the proposal above. One implicit advantage of the above is that the level of JWT granularity is decoupled from the routing, and the user can choose how to organize the JWT authn. I can, for example, have 100 route entries, but only 2 jwt-authn rules filtering for audiences of \"/api/v1/\" and \"/api/v2/\". That's just an example, but the main idea is that the granularity is configurable.\r\n\r\nJust curious, is there a reason why this wouldn't work? If we're just bottelenecked on developer time I can help out, but if it's there's a design flaw/deficiency I'd love to get some more concrete feedback."}}
{"actor":{"display_login":"llchan"}}