Merge pull request #36769 from deads2k/auth-03-fix-impersonation

Automatic merge from submit-queue clear impersonation headers If you clone a request that came in after impersonation, you were also cloning the impersonation headers that came with it. These seem roughly analogous to the `Authorization` header, so this clears them. @kubernetes/sig-auth

Merge pull request #36769 from deads2k/auth-03-fix-impersonation
d00696a0 · Kubernetes Submit Queue · GitHub · 2fab1993 · e69d0d84 · d00696a0
Commit d00696a0 authored Dec 01, 2016 by Kubernetes Submit Queue Committed by GitHub Dec 01, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 9 additions and 0 deletions

impersonation.go pkg/apiserver/filters/impersonation.go +9 -0

No files found.
--- a/pkg/apiserver/filters/impersonation.go
+++ b/pkg/apiserver/filters/impersonation.go
@@ -123,6 +123,15 @@ func WithImpersonation(handler http.Handler, requestContextMapper api.RequestCon
 		oldUser, _ := api.UserFrom(ctx)
 		httplog.LogOf(req, w).Addf("%v is acting as %v", oldUser, newUser)
+		// clear all the impersonation headers from the request
+		req.Header.Del(authenticationapi.ImpersonateUserHeader)
+		req.Header.Del(authenticationapi.ImpersonateGroupHeader)
+		for headerName := range req.Header {
+			if strings.HasPrefix(headerName, authenticationapi.ImpersonateUserExtraHeaderPrefix) {
+				req.Header.Del(headerName)
+			}
+		}
 		handler.ServeHTTP(w, req)
 	})
 }