fix: enforce token checks in gateway and edge examples and fix IaC configs

[jhickmanit]

Corrects the API gateway, edge token validation, IaC, feature flag, and self-hosted infrastructure integrations so their configuration runs and validates Ory tokens correctly.

Changes

• Kong:
  • kong.yaml puts the JWKS public key in rsa_public_key, which the OSS jwt plugin requires because it does not fetch JWKS.
  • Tokens are accepted only from the Authorization header.
  • A sandbox-safe post-function enforces the audience and nbf and sets X-User-Id.
  • The public route clears client-supplied identity headers.
  • The Enterprise OIDC config uses the exact issuer and requires the audience.
• Traefik:
  • The forwardauth service starts on Express 5 and ships a Dockerfile.
  • Public-path matching normalizes the path.
  • Identity headers are replaced or removed on every route. The compose file sets aliasHeadersStrategy=delete, and the Kubernetes manifest gives the matching Helm argument, so a client-sent X_User_Id can't reach the backend as X-User-Id.
  • Non-ASCII names and emails are left out of the headers; X-User-Metadata is JSON with non-ASCII escaped.
• Cloudflare Workers:
  • The worker accepts RS256 only, selects the key by kid, and enforces iss, aud, exp, and nbf.
  • It strips incoming identity headers, including on public paths.
  • It caches session lookups per credential for 30 s and returns 503 when Ory is unreachable.
  • npm run dev works without a prior build.
• Envoy, Apigee, AWS API Gateway, Akamai, and Fastly: the READMEs say to enable JWT access tokens and set the audience, and they give the exact issuer, with no trailing slash. Envoy verifies the JWKS TLS certificate.
• Feature flags:
  • LaunchDarkly builds a multi-kind context (tier, groups, organization), and its wrapper forwards session tokens as well as cookies.
  • Split uses ory.toSession().
• Terraform: the examples pin ory/ory ~> 26.3 and use only real provider arguments. Actions are created per enabled authentication method. Stripe uses an ignored response after identity persistence, the URLs match the companion handlers, and Segment and Splunk have separate body templates. They ship the Jsonnet files they reference, and the README documents the import ID formats and which API key each resource needs.
• Self-hosted: the OpenTelemetry, Datadog, New Relic, CockroachDB, Docker, Kubernetes, AWS, Azure, GCP, Helm, and Pulumi pages use working configuration. OTEL_RESOURCE_ATTRIBUTES is merged, but service.name and deployment.environment.name come from Ory's tracing config.

Deployment notes

• Kong's compose file binds the admin API to localhost and stops publishing port 8001.
• The Kong and Traefik examples now reject requests the old configs accepted: query-string tokens, wrong audiences, and forged identity headers.

Validation

• Kong 3.9 in Docker: valid tokens pass, and wrong audience, expired, future nbf, wrong issuer, alg: none, HS256, and query-string tokens are rejected. Forged headers are replaced.
• Traefik 3.7 compose stack: session gating, header stripping, X-Forwarded-Uri spoofing, and dot-segment traversal. A mock Ory run also covered Unicode profiles.
• Cloudflare Worker: typecheck and build pass, and a 27-case harness covers JWT, key rotation, and session paths.
• LaunchDarkly TestData targeting matched.
• Both examples pass terraform init, fmt -check, and validate with Terraform 1.16.5 and ory/ory 26.3.6. Changed Jsonnet bodies pass null/missing/populated payload and handler-shape checks. No infrastructure was applied.
• Not verified: the Datadog agentless host and the Akamai CPU tier figures. Both come from vendor information that could not be confirmed against vendor documentation.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7494c492-d09d-443c-8bed-d534871ad765

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}