<p>I'm trying to set up end user authentication with JWT in Istio as described here: <a href="https://istio.io/help/ops/security/end-user-auth/" rel="nofollow noreferrer">https://istio.io/help/ops/security/end-user-auth/</a></p>

<p>Here are the steps to reproduce:</p>

<ol>
<li>Set up Istio locally: <a href="https://github.com/nheidloff/cloud-native-starter/blob/master/LocalEnvironment.md" rel="nofollow noreferrer">https://github.com/nheidloff/cloud-native-starter/blob/master/LocalEnvironment.md</a></li>
<li>Set up HTTPS, sample services and Ingress: <a href="https://github.com/nheidloff/cloud-native-starter/blob/master/istio/IstioIngressHTTPS.md" rel="nofollow noreferrer">https://github.com/nheidloff/cloud-native-starter/blob/master/istio/IstioIngressHTTPS.md</a></li>
<li>kubectl apply -f <a href="https://github.com/nheidloff/cloud-native-starter/blob/master/istio/access.yaml" rel="nofollow noreferrer">https://github.com/nheidloff/cloud-native-starter/blob/master/istio/access.yaml</a></li>
</ol>

<p>I created a little app to get a JWT token for a user. I've checked that the token is valid via <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a>.</p>

<p>When I invoke the following URLs, I get the same error:</p>

<pre><code>curl -k https://web-api.local:31390/web-api/v1/getmultiple
curl -k https://web-api.local:31390/web-api/v1/getmultiple --header 'Authorization: Bearer eyJhbGciOiJIU.........wOeF_k'
</code></pre>

<p>HTTP Status Code: 503
<strong>upstream connect error or disconnect/reset before headers</strong></p>

<p>I don't see any entries related to these requests in the istio-proxy logs. I assume that means that something goes wrong before the request even arrives at the proxy.</p>

<pre><code>kubectl logs web-api-v1-545f655f67-fhppt istio-proxy
</code></pre>

<p>I've tried Istio 1.0.6 and 1.1.1. </p>

<p>I've run out of ideas what else to try. Any help is much appreciated! Thanks!</p>

Niklas Heidloff
<p>I found the issue. The trick was to remove mtls from my yaml. When I read the Istio documentation it sounded like this was a prerequisite. </p>
