Repository: envoyproxy/envoy
File: source/extensions/filters/http/oauth2/config.cc (C++)

Code before:
  const auto& proto_config = proto.config();
  const auto& credentials = proto_config.credentials();

  const auto& client_secret = credentials.token_secret();
  const auto& hmac_secret = credentials.hmac_secret();
  const auto auth_type = proto_config.auth_type();

  auto& server_context = context.serverFactoryContext();
  auto& cluster_manager = context.serverFactoryContext().clusterManager();

  // token_secret is required unless auth_type is TLS_CLIENT_AUTH
  if (auth_type !=
      envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH) {
    if (!credentials.has_token_secret()) {
      return absl::InvalidArgumentError(
          "token_secret is required when auth_type is not TLS_CLIENT_AUTH");
    }
  }
  if (auth_type ==
          envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH &&
      credentials.has_token_secret()) {
    ENVOY_LOG_MISC(warn,
                   "OAuth2 filter: token_secret is ignored when auth_type is TLS_CLIENT_AUTH");
  }
  Secret::GenericSecretConfigProviderSharedPtr secret_provider_client_secret = nullptr;
  if (credentials.has_token_secret()) {
    secret_provider_client_secret =
        secretsProvider(client_secret, server_context, context.initManager());
    if (secret_provider_client_secret == nullptr) {
      return absl::InvalidArgumentError("invalid token secret configuration");
    }
  }
  auto secret_provider_hmac_secret =
      secretsProvider(hmac_secret, server_context, context.initManager());
  if (secret_provider_hmac_secret == nullptr) {
    return absl::InvalidArgumentError("invalid HMAC secret configuration");
  }

  if (proto_config.preserve_authorization_header() && proto_config.forward_bearer_token()) {
    return absl::InvalidArgumentError(
        "invalid combination of forward_bearer_token and preserve_authorization_header "
        "configuration. If forward_bearer_token is set to true, then "
        "preserve_authorization_header must be false");
  }

  auto secret_reader = std::make_shared<SDSSecretReader>(
      std::move(secret_provider_client_secret), std::move(secret_provider_hmac_secret),
      context.serverFactoryContext().threadLocal(), context.serverFactoryContext().api());
  auto config = std::make_shared<FilterConfig>(proto_config, context.serverFactoryContext(),
                                               secret_reader, context.scope(), stats_prefix);


Review comment (security):
This is not required when auth_type ==      envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH .

Code after:
  const auto& proto_config = proto.config();
  const auto& credentials = proto_config.credentials();

  const auto& client_secret = credentials.token_secret();
  const auto& hmac_secret = credentials.hmac_secret();
  const auto auth_type = proto_config.auth_type();

  auto& server_context = context.serverFactoryContext();
  auto& cluster_manager = context.serverFactoryContext().clusterManager();

  // token_secret is required unless auth_type is TLS_CLIENT_AUTH
  if (auth_type !=
      envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH) {
    if (!credentials.has_token_secret()) {
      return absl::InvalidArgumentError(
          "token_secret is required when auth_type is not TLS_CLIENT_AUTH");
    }
  }
  if (auth_type ==
          envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH &&
      credentials.has_token_secret()) {
    ENVOY_LOG_MISC(debug,
                   "OAuth2 filter: token_secret is ignored when auth_type is TLS_CLIENT_AUTH");
  }
  Secret::GenericSecretConfigProviderSharedPtr secret_provider_client_secret = nullptr;
  if (credentials.has_token_secret() &&
      auth_type !=
          envoy::extensions::filters::http::oauth2::v3::OAuth2Config_AuthType_TLS_CLIENT_AUTH) {
    secret_provider_client_secret =
        secretsProvider(client_secret, server_context, context.initManager());
    if (secret_provider_client_secret == nullptr) {
      return absl::InvalidArgumentError("invalid token secret configuration");
    }
  }
  auto secret_provider_hmac_secret =
      secretsProvider(hmac_secret, server_context, context.initManager());
  if (secret_provider_hmac_secret == nullptr) {
    return absl::InvalidArgumentError("invalid HMAC secret configuration");
  }

  if (proto_config.preserve_authorization_header() && proto_config.forward_bearer_token()) {
    return absl::InvalidArgumentError(
        "invalid combination of forward_bearer_token and preserve_authorization_header "
        "configuration. If forward_bearer_token is set to true, then "
        "preserve_authorization_header must be false");
  }

  auto secret_reader = std::make_shared<SDSSecretReader>(
      std::move(secret_provider_client_secret), std::move(secret_provider_hmac_secret),
      context.serverFactoryContext().threadLocal(), context.serverFactoryContext().api());
  auto config = std::make_shared<FilterConfig>(proto_config, context.serverFactoryContext(),