docs: inputs: http: add OAuth 2.0 JWT validation and remote_addr_key parameters#2502
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughDocumentation for the HTTP input plugin was updated to include newly supported OAuth 2.0 JWT validation configuration parameters, the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pipeline/inputs/http.md (1)
315-359: Consider addingoauth2.allowed_clientsto the example.While the example demonstrates the core OAuth 2.0 JWT validation parameters, it omits
oauth2.allowed_clientswhich is documented in the parameters table. Adding this optional parameter would provide a more complete reference for users who need to restrict access by client ID.💡 Enhanced example with allowed_clients
For the YAML example:
oauth2.validate: true oauth2.issuer: https://auth.example.com oauth2.jwks_url: https://auth.example.com/.well-known/jwks.json oauth2.allowed_audience: my-service + oauth2.allowed_clients: + - client-app-1 + - client-app-2 oauth2.jwks_refresh_interval: 300For the .conf example:
Oauth2.validate true Oauth2.issuer https://auth.example.com Oauth2.jwks_url https://auth.example.com/.well-known/jwks.json Oauth2.allowed_audience my-service + Oauth2.allowed_clients client-app-1 + Oauth2.allowed_clients client-app-2 Oauth2.jwks_refresh_interval 300🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pipeline/inputs/http.md` around lines 315 - 359, Add the optional oauth2.allowed_clients parameter to both example configurations so readers can restrict accepted client IDs; update the YAML under the pipeline.inputs.http block to include oauth2.allowed_clients (e.g., a comma-separated string or list value alongside oauth2.allowed_audience) and update the fluent-bit.conf INPUT section to include Oauth2.allowed_clients with the same format, ensuring the key name matches oauth2.allowed_clients (YAML) and Oauth2.allowed_clients (fluent-bit.conf) used elsewhere in the doc.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pipeline/inputs/http.md`:
- Around line 37-41: Update the OAuth 2.0 JWT section to explicitly state that
JWKS are fetched lazily on the first incoming request when oauth2.validate is
true: mention that the initial JWKS fetch happens on the first request requiring
validation (using oauth2.jwks_url), the keys are then cached and refreshed every
oauth2.jwks_refresh_interval seconds, and that oauth2.issuer and oauth2.jwks_url
are required when validation is enabled; keep the phrasing concise and add a
short note that requests before the first fetch will trigger the initial JWKS
retrieval.
---
Nitpick comments:
In `@pipeline/inputs/http.md`:
- Around line 315-359: Add the optional oauth2.allowed_clients parameter to both
example configurations so readers can restrict accepted client IDs; update the
YAML under the pipeline.inputs.http block to include oauth2.allowed_clients
(e.g., a comma-separated string or list value alongside oauth2.allowed_audience)
and update the fluent-bit.conf INPUT section to include Oauth2.allowed_clients
with the same format, ensuring the key name matches oauth2.allowed_clients
(YAML) and Oauth2.allowed_clients (fluent-bit.conf) used elsewhere in the doc.
…parameters
- Add oauth2.validate, oauth2.issuer, oauth2.jwks_url,
oauth2.allowed_audience, oauth2.allowed_clients, and
oauth2.jwks_refresh_interval config parameters to the table
- Add remote_addr_key config parameter to the table
- Add "OAuth 2.0 JWT validation" section explaining the feature
and required parameters
- Add configuration examples for OAuth 2.0 JWT validation in
YAML and classic .conf format
- Fix parameter table sort order
- Clarify OAuth 2.0 JWKS lazy fetch behavior
Fixes fluent#2500
Signed-off-by: Eric D. Schabell <eric@schabell.org>
eschabell
force-pushed
the
erics_in_http_jan_2026_audit
branch
from
2a49033 to
6d62d6f
Compare
|
@patrick-stephens ready for review! |
2 participants
Fixes #2500
Summary by CodeRabbit
remote_addr_keyparameter for controlling record field names