Skip to content

Commit a0c8c04

Browse files
committed
Fix typo and update validation section
1 parent 65c1adc commit a0c8c04

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

docs/proposals/authentication-filter.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -909,7 +909,9 @@ When referencing an `AuthenticationFilter` in either a HTTPRoute or GRPCRoute, i
909909
All fields in the `AuthenticationFilter` will be validated with Open API Schema.
910910
We should also include [CEL](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#validation-rules) validation where required.
911911

912-
We should validated that only one `AuthenticationFilter` is referenced per-rule. Multiple references to an `AuthenticationFilter` in a single rule should result in an `Invalid` HTTPRoute/GRPCRoute, and the resource should be `Rejected`.
912+
We should validated that only one `AuthenticationFilter` is referenced per-rule. Multiple references to an `AuthenticationFilter` in a single rule should result in an `Invalid` HTTPRoute/GRPCRoute, and the rule should be `Rejected`.
913+
914+
This scenario can use the status `RouteConditionPartiallyInvalid` defined in the Gateway API here: https://github.com/nginx/nginx-gateway-fabric/blob/main/internal/controller/state/conditions/conditions.go#L402
913915

914916
An `AuthenticationFilter` that sets a `onFailure.statusCode` to anything other than `401` or `403` should be rejected. This relates to the "Auth failure behaviour" section in the Security Considerations section.
915917

0 commit comments

Comments
 (0)