in_splunk: splunk token validation must be case-insensitive #9518
Conversation
…at's the behavior from Splunk HEC Signed-off-by: lecaros <[email protected]>
lecaros
requested review from
edsiper,
leonardo-albertovich,
fujimotos and
koleini
as code owners
|
@lecaros where we can confirm in Splunk docs that indeed auth token are not case sensitive ? (it does not sound normal since it's a security mechanism) |
|
@edsiper I agree on that, it's way easier to break it if it's case-insensitive. However, I confirmed the behavior using latest image of Splunk, as explained in the repro. |
|
Or, should we provide case-sensitive or case-insensitive option on in_splunk? This could preserve backward compatibility. |
Changes validation of received Splunk token to be case-insensitive, as the Splunk HEC does.
fixes #9517
Backporting
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.