LoginSign Up
← Back to all sparks
S

Skipper

INFRA · APIS
Velocity5.0

HTTP router and reverse proxy for service composition

opensource.zalando.com/skipper ↗

Skipper fixes a 304 path that could drop active routes after an interrupted download.

http-routerkubernetes-ingressauthorizationsecurity-fixespath-normalization
◆Current state
Skipper, Zalando's HTTP router and Kubernetes ingress, tagged a dozen releases in early November, most of them security fixes in how filters see the request path. v0.28.72 and v0.28.74 made the oidcClaimsQuery and OPA filters check the normalized path. v0.28.76 on November 12 fixes a route-loading bug: an interrupted route download could save an incomplete cache with a new ETag, and a 304 reply then removed routes that were active.
◆Where it's heading
After the auth-filter fixes, the work has moved to the route data client, where a partial download combined with ETag caching could take routes out of service. The project is in a hardening phase across both request handling and configuration loading.
◆Prediction
Expect further v0.28.x tags fixing edge cases in route loading and filters; the entries show no feature work queued.

◆Recent moves

  1. 1d ago

    v0.28.76: interrupted route download no longer drops live routes

    An interrupted route download could store an incomplete route list with the new ETag, and a later 304 made Skipper load it and remove routes that were active. The fix closes an outage path in configuration loading, following last week's path-normalization fixes in the auth filters.

    View source ↗
  2. 4d ago

    v0.28.75: switch PR labeler to pull_request trigger

    Changes the trigger of the repository's PR labeler workflow. Project housekeeping with no effect on the router.

    View source ↗
  3. 4d ago

    v0.28.74: OPA filters now check the normalized path

    Fixes GHSA-q9xq-w3q4-p9jc: OPA filters saw the raw request path while route matching used the normalized one, so a crafted path could get a different policy decision. It is the second path-spelling authorization fix in one day.

    View source ↗
  4. 4d ago

    v0.28.73: auto-label change-freeze PRs

    Adds automatic labels for change-freeze pull requests in the build tooling. No user-visible change.

    View source ↗
  5. 4d ago

    v0.28.72: oidcClaimsQuery evaluates the cleaned path

    Requests to //login/page or /x/../login/page were checked against the / claim rule instead of /login, returning 200 to users the docs example should reject. Claim queries now use the same cleaned path as routing, closing a real bypass for backends that normalize paths.

    View source ↗
  6. 7d ago

    v0.28.71: per-application proxy logs via annotate

    Proxy logs can be tagged per application through the annotate filter. A small observability option for multi-tenant ingress.

    View source ↗