Does OPA support headers?

[kotyara85]

Per docs

    # Request headers represented as an object of string arrays.
    #
    # Example Request Headers:
    #
    #   host: acmecorp.com
    #   x-custom: secretvalue
    #
    # Example input.headers Value:
    #
    #   {"Host": ["acmecorp.com"], "X-Custom": ["mysecret"]}
    #
    # Example header check:
    #
    #   input.headers["X-Custom"][_] = "mysecret"
    #
    # Header keys follow canonical MIME form. The first character and any
    # characters following a hyphen are uppercase. The rest are lowercase.
    # If the header key contains space or invalid header field bytes,
    # no conversion is performed.
    "headers": {"...": [...]},

I tried to pass a bearer token but headers are nil

headers = input.headers

[srenatus]

I'm afraid those docs are for the system policy that can be used to protect OPA's REST API, https://www.openpolicyagent.org/docs/latest/security/#authentication-and-authorization.

For queries, i.e. requests to /v1/data/some/package/rule, request headers are not available. If you want something to be available there, you need to provide it as input.

[kotyara85]

I see, is there a way to sanitize logs then? Cause if debug mode enabled, all user tokens get exposed right away. Thanks

[anderseknert]

@kotyara85 the recommended log level for production is error — if you enable decision logs, you'll have a way of logging the actual decisions made by OPA, which is normally what you'll want anyway. Decision logs also provide a way to mask sensitive values from the logs.