Skip to content

sys: don't set X-Vault-Namespace header for root-only paths  #14934

@aead

Description

@aead

Describe the bug
Vault exposes root-only API paths. For example: `sys/health.
Ref: https://www.vaultproject.io/docs/enterprise/namespaces#root-only-api-paths

However, a vault.Client with a namespace set via SetNamespace sends the X-Vault-Namespace header to those root-only API paths.
For example:

User-Agent: [Go-http-client/1.1]
X-Vault-Namespace: [test]
X-Vault-Request: [true]
X-Vault-Token: [abc]
Accept-Encoding: [gzip]

This causes Vault 1.9.1 to respond with:

Code: 404. Errors:

    unsupported path

To Reproduce

As a simple reproducer - the 1st curl request succeeds while the 2nd fails:

curl -L -X GET "https://localhost:8200/v1/sys/health?drsecondarycode=299&performancestandbycode=299&sealedcode=299&standbycode=299&uninitcode=299"

curl -L -X GET -H 'X-Vault-Namespace: test' "https://localhost:8200/v1/sys/health?drsecondarycode=299&performancestandbycode=299&sealedcode=299&standbycode=299&uninitcode=299"

Expected behavior
Either thevault.Client should not send the X-Vault-Namespace header for root-only API paths or Vault itself should ignore this header in such a case.

Environment:

  • Vault Server Version (retrieve with vault status): 1.9.1
  • Vault SDK Version (retrieve with vault version): 1.5.0
  • Server Operating System/Architecture: linux/amd64

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugUsed to indicate a potential bugcore/apidevexDeveloper Experience

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions