Loading…
Timezone
October 24, 2022 | Detroit, Michigan
View More Details & Registration Information 

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for KubeCon + CloudNativeCon North America 2022 - Detroit, MI + Virtual and add this Co-Located event to your registration to participate in these sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

Please note: This schedule is automatically displayed in Eastern Daylight Time (EDT), UTC -4. To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

The schedule is subject to change.
Back To Schedule
Monday, October 24 • 4:10pm - 4:20pm
⚡ Lightning Talk: Access Control and URI Path Normalization - Yan Avlasov, Google

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.
Majority of Envoy’s access control policies are defined using the path component of the request URL. How can we be sure that URL Path Based Access Policies (PBAC) can not be bypassed? Two nominally different URL paths may in fact identify the same resource, and need to be normalized to their canonical form, before comparison. The normalization is standardized in RFC 3986, however it may not be enough to ensure safety of the access control. In this talk we explore the effects of URL path normalization on request access control, Envoy’s configuration options for path normalization and general principles for ensuring the safety of the PBAC policies.
Speakers
avatar for Yan Avlasov

Yan Avlasov

Software Engineer, Google
Yan Avlasov is a senior maintainer of Envoy proxy with the focus on the dataplane and security. Yan works at Google, helping teams deploy Envoy based products and ensuring that Envoy and Envoy based products meet Google’s standards for safety and security.

Access Control and URI Path Normalization pdf
Monday October 24, 2022 4:10pm - 4:20pm EDT
Room 310 B Huntington Place: 1 Washington Blvd, Detroit, MI 48226
  Lightning Talks