Skip to content

Incorrect urlencoding causes permission denied errors #350

@jaark

Description

@jaark

The Ruby gem applies urlencoding to the hyphen ('-') character when making requests.
At some point between vault server 1.15 and 1.20.3 the handling of urlencoded paths has changed and a urldecode process no longer gets applied before checking permissions.

So when making the following requests against an up to date server

logical.read("/auth/token/lookup-self")

produces a 403 - permission denied error from the Vault server.

It looks like PR #343 fixes this issue

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions