Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  GitHub Stars
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

cloudfoundry / routing-release Public

Notifications You must be signed in to change notification settings
Fork 111
Star 181

Code
Issues 16
Pull requests 3
Actions
Projects
Wiki
Security and quality
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Wiki
Security and quality
Insights

RFC0055 Identity-Aware Routing#535

Open

rkoster wants to merge 62 commits into

developcloudfoundry/routing-release:developfrom

feature/app-to-app-mtls-routingcloudfoundry/routing-release:feature/app-to-app-mtls-routingCopy head branch name to clipboard

Conversation Commits62 (62)Checks Files changed

Open

RFC0055 Identity-Aware Routing#535
rkoster wants to merge 62 commits into
developfrom
feature/app-to-app-mtls-routing

Commits

Commits on May 13, 2026

Fix issues found in code review

hoffmaen
authored and
rkoster
committed
Add per-domain mTLS configuration support to GoRouter config
rkoster
committed
Implement per-domain TLS configuration via GetConfigForClient
rkoster
committed
Make clientcert handler domain-aware
rkoster
committed
Add BOSH configuration support for mTLS domains
rkoster
committed
Add AllowedSources support for mTLS authorization (Phase 1b partial)
rkoster
committed
Copy AllowedSourceAppGUIDs in NewEndpoint constructor
rkoster
committed
Add identity extraction handler for mTLS caller identification
rkoster
committed
Add mTLS authorization handler for app-to-app access control
rkoster
committed
Wire identity and authorization handlers into proxy chain
rkoster
committed
Add AllowedSourceAppGUIDs support to route-registrar
rkoster
committed
Fix domain names to match RFC specification
rkoster
committed
Expand AllowedSources to full RFC specification
rkoster
committed
Add comprehensive integration tests for mTLS app-to-app routing
rkoster
committed
Fix vendor dependencies broken by commit 0a13b3ed3
rkoster
committed
Fix mTLS authorization to use RoutePool instead of RouteEndpoint
rkoster
committed
Support allowed_sources nested in options for CAPI/Diego integration
rkoster
committed
Fix identity extraction to handle GoRouter XFCC format (raw base64)
rkoster
committed
Rename AllowedSources to MtlsAllowedSources for clarity
rkoster
committed
Add configurable XFCC format support (raw/envoy)
rkoster
committed
Emit RTR access logs for denied mTLS requests
rkoster
committed
Refactor mTLS route options to RFC-0027 compliant flat format
rkoster
committed
Implement RFC domain-scoped mTLS app-to-app routing in GoRouter
rkoster
committed
feat(gorouter): implement RFC-compliant post-selection mTLS authorization
rkoster
committed
refactor: rename MtlsAuthError to AuthError for future extensibility
rkoster
committed
refactor: extract shared mTLS helper functions to mtls_helpers.go
rkoster
committed
refactor: remove deprecated mtls_authorization handler
rkoster
committed
refactor: move helper functions to their respective handlers
rkoster
committed
refactor: introduce AuthResult and remove mTLS-specific naming
rkoster
committed
refactor: rename test variable mtlsErr to authErr for consistency
rkoster
committed
refactor: rename mtlsAllowedSources parameter to allowedSources in test helper
rkoster
committed
refactor: align integration test naming with RFC terminology
rkoster
committed
refactor: remove unused EndpointPool methods from deprecated pre-selection auth
rkoster
committed
refactor: remove identity-aware routing fields from route-registrar
rkoster
committed
chore: add devbox files to .gitignore
rkoster
committed
fix: remove routing-api from go.mod dependencies
rkoster
committed
chore: update go.sum and vendor/modules.txt after rebase
rkoster
committed
fix: run gofmt on post_selection_pipeline_test.go
rkoster
committed
fix: run gofmt on all modified Go files
rkoster
committed
fix: resolve go vet and staticcheck issues
rkoster
committed
fix: resolve integration test failures for identity-aware routing
rkoster
committed
fix: run gofmt on modified files
rkoster
committed
chore: trigger CI after rebase on develop
rkoster
committed
fix: stop router before NATS in integration test cleanup
rkoster
committed
chore: trigger CI for port conflict fix
rkoster
committed
refactor: rebrand access rules to route policies terminology
rkoster
committed
fix: apply gofmt to test files for CI compliance
rkoster
committed
fix: update integration test to use renamed struct fields
rkoster
committed
fix: route policy enforcement on routes without enforcement enabled
rkoster
committed
fix: strip port from Host header before mTLS domain matching
rkoster
committed
fix: apply gofmt to mtls_route_policies_auth_test.go
rkoster
committed
fix(test): correct expectations for routes without enforcement enabled
rkoster
committed
fix: update routing-api submodule to gorm v2 compatible commit (93579f8f2)
rkoster
committed
fix: address PR #535 code review findings
rkoster
committed
fix: resolve PR #535 code review findings
rkoster
committed
fix: address critical security and correctness issues in mTLS routing
rkoster
committed
fix: add missing tests and fix AuthError dead-code path in proxy pipeline
rkoster
committed
fix: reject always_forward+xfcc_format combination at deploy time
rkoster
committed
Validate xfcc_format + always_forward conflict at Go config level
rkoster
committed
go mod tidy && go mod vendor
rkoster
committed
fix: run go mod tidy && go mod vendor, remove routing-api external dep to resolve ambiguous import
rkoster
committed
fix: add missing locket/lock, cactus/go-statsd-client and grpc/transport/readyreader to routing-api BOSH package spec
rkoster
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.