跨源读取阻止（CORB）是指在istio授权策略中设置notpaths配置时发生的情况。

huangapple
go评论105阅读模式
英文:

Cross-Origin Read Blocking (CORB) occurs when setting notpaths config in istio authorization policy

问题

我正在进行Istio配置，以构建自动授权系统。

我使用oauth2-proxy进行外部授权，使用dex进行OICD。

我必须避免对某些子地址进行授权检查，所以我在授权策略中设置了notPaths选项。

但是每次我设置notPaths选项时，网页都会变成空白白页，而不是显示正确的页面。控制台显示CORB警告标志。

我不知道为什么会发生这种情况。

以下是我的授权策略、网关和虚拟服务配置。

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4.   name: oauth-policy
  5.   namespace: istio-system
  6. spec:
  7.   selector:
  8.     matchLabels:
  9.       istio: ingressgateway
  10.   action: CUSTOM
  11.   provider:
  12.     name: "oauth2-proxy"
  13.   rules:
  14.   - to:
  15.     - operation:
  16.         hosts:
  17.         - "my.domain.com"
  18.         notPaths:
  19.         - "/main*"
  20. ---
  22. apiVersion: networking.istio.io/v1alpha3
  23. kind: Gateway
  24. metadata:
  25.   name: cm-gateway
  26.   namespace: cm-temp
  27. spec:
  28.   selector:
  29.     istio: ingressgateway # use Istio default gateway implementation
  30.   servers:
  31.   - port:
  32.       number: 80
  33.       name: http
  34.       protocol: HTTP
  35.     hosts:
  36.     - "my.domain.com"
  38. ---
  40. apiVersion: networking.istio.io/v1alpha3
  41. kind: VirtualService
  42. metadata:
  43.   name: cm-vs
  44.   namespace: cm-temp
  45. spec:
  46.   hosts:
  47.   - "my.domain.com"
  48.   gateways:
  49.   - cm-gateway
  50.   http:
  51.   - match:
  52.     - uri:
  53.         prefix: /api
  54.     route:
  55.     - destination:
  56.         host: cm-be-svc
  57.         port:
  58.           number: 5000
  59.   - match:
  60.     - uri:
  61.         prefix: /
  62.     route:
  63.     - destination:
  64.         host: cm-fe-svc
  65.         port:
  66.           number: 80
英文:

i'm working on istio configuration to build automatic authorization system.

I use oauth2-proxy for external authorization and dex for OICD.

I have to avoid authorization check for certain sub adress, so I set notPaths option in authorization policy.

But every time I set the notPaths option, the web goes blank white page instead of display proper page. And console shows CORB warning sign.

I don't have any clue why this heppens.

here is my authorization policy and gateway, virtual service configuration.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4.   name: oauth-policy
  5.   namespace: istio-system
  6. spec:
  7.   selector:
  8.     matchLabels:
  9.       istio: ingressgateway
  10.   action: CUSTOM
  11.   provider:
  12.     name: "oauth2-proxy"
  13.   rules:
  14.   - to:
  15.     - operation:
  16.         hosts:
  17.         - "my.domain.com"
  18.         notPaths:
  19.         - "/main*"
  20. ---
  22. apiVersion: networking.istio.io/v1alpha3
  23. kind: Gateway
  24. metadata:
  25.   name: cm-gateway
  26.   namespace: cm-temp
  27. spec:
  28.   selector:
  29.     istio: ingressgateway # use Istio default gateway implementation
  30.   servers:
  31.   - port:
  32.       number: 80
  33.       name: http
  34.       protocol: HTTP
  35.     hosts:
  36.     - "my.domain.com"
  38. ---
  39. apiVersion: networking.istio.io/v1alpha3
  40. kind: VirtualService
  41. metadata:
  42.   name: cm-vs
  43.   namespace: cm-temp
  44. spec:
  45.   hosts:
  46.   - "my.domain.com"
  47.   gateways:
  48.   - cm-gateway
  49.   http:
  50.   - match:
  51.     - uri:
  52.         prefix: /api
  53.     route:
  54.     - destination:
  55.         host: cm-be-svc
  56.         port:
  57.           number: 5000
  58.   - match:
  59.     - uri:
  60.         prefix: /
  61.     route:
  62.     - destination:
  63.         host: cm-fe-svc
  64.         port:
  65.           number: 80

答案1

得分: -1

这是授权策略配置问题。

我使用React来显示页面，由于我没有添加其子地址，所以首页的地址被阻止了。

我将子地址添加到了授权策略中，然后它就起作用了。

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4.   name: oauth-policy
  5.   namespace: istio-system
  6. spec:
  7.   selector:
  8.     matchLabels:
  9.       istio: ingressgateway
  10.   action: CUSTOM
  11.   provider:
  12.     name: "oauth2-proxy"
  13.   rules:
  14.   - to:
  15.     - operation:
  16.         hosts:
  17.         - "my.domain.com"
  18.         notPaths:
  19.         - "/main*"
  20.         - "/index*"
  21.         - "/favicon*"
英文:

It was the authorization policy config problem.

I use react to display page, and the address of index page was blocked cuz i didn't add the sub address of it.

i add the sub address to auth policy and it worked.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4.   name: oauth-policy
  5.   namespace: istio-system
  6. spec:
  7.   selector:
  8.     matchLabels:
  9.       istio: ingressgateway
  10.   action: CUSTOM
  11.   provider:
  12.     name: "oauth2-proxy"
  13.   rules:
  14.   - to:
  15.     - operation:
  16.         hosts:
  17.         - "my.domain.com"
  18.         notPaths:
  19.         - "/main*"
  20.         - "/index*"
  21.         - "/favicon*"

huangapple
  • 本文由 发表于 2022年9月16日 10:57:54
  • 转载请务必保留本文链接：https://go.coder-hub.com/73739390.html
  • go
  • istio
  • kubernetes
  • oauth2-proxy
  • reactjs
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定