Repository: envoyproxy/envoy
File: source/extensions/filters/http/ext_authz/ext_authz.cc (C++)

Code before:
      headers.addCopy(key, value);
    }
  }

  if (!response_headers_to_set_.empty()) {
    ENVOY_STREAM_LOG(
        trace, "ext_authz filter set header(s) to the encoded response:", *encoder_callbacks_);
    for (const auto& [key, value] : response_headers_to_set_) {
      if (headers.get(key).empty() && headers.size() >= headers.maxHeadersCount()) {
        ENVOY_STREAM_LOG(trace, "Cannot add new response header, header map is full.",
                         *encoder_callbacks_);
        // Continue because there could be other existing headers that can be set without increasing
        // the number of headers.
        continue;
      }
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key.get(), value);
      headers.setCopy(key, value);
    }
  }

  if (!response_headers_to_add_if_absent_.empty()) {
    for (const auto& [key, value] : response_headers_to_add_if_absent_) {
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key.get(), value);
      if (auto header_entry = headers.get(key); header_entry.empty()) {
        if (headers.size() >= headers.maxHeadersCount()) {
          ENVOY_STREAM_LOG(warn, "Cannot add new response header, header map is full.",
                           *encoder_callbacks_);
          break;
        }
        ENVOY_STREAM_LOG(trace, "ext_authz filter added header(s) to the encoded response:",
                         *encoder_callbacks_);
        headers.addCopy(key, value);
      }
    }
  }

  if (!response_headers_to_overwrite_if_exists_.empty()) {
    for (const auto& [key, value] : response_headers_to_overwrite_if_exists_) {
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key, value);
      if (auto header_entry = headers.get(key); !header_entry.empty()) {
        ENVOY_STREAM_LOG(
            trace, "ext_authz filter set header(s) to the encoded response:", *encoder_callbacks_);
        headers.setCopy(key, value);
      }
    }
  }
  return Http::FilterHeadersStatus::Continue;
}

Http::FilterDataStatus Filter::encodeData(Buffer::Instance&, bool) {
  return Http::FilterDataStatus::Continue;

Review comment (suggestion):
This one is at `warn`, all the other logs are at `trace`.

This could be a serious condition (application may not work without response headers added). I'm not sure I agree with continuing without adding these headers. At a minimum, I'd say a counter should be incremented and/or a `warn` level log message emitted. 

But possibly, the request should be rejected with an error (not access denied).

Code after:
        trace, "ext_authz filter added header(s) to the encoded response:", *encoder_callbacks_);
    for (const auto& [key, value] : response_headers_to_add_) {
      if (headers.size() >= headers.maxHeadersCount()) {
        omitted_response_headers = true;
        break;
      }
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key.get(), value);
      headers.addCopy(key, value);
    }
  }

  if (!response_headers_to_set_.empty()) {
    ENVOY_STREAM_LOG(
        trace, "ext_authz filter set header(s) to the encoded response:", *encoder_callbacks_);
    for (const auto& [key, value] : response_headers_to_set_) {
      if (headers.get(key).empty() && headers.size() >= headers.maxHeadersCount()) {
        omitted_response_headers = true;
        // Continue because there could be other existing headers that can be set without increasing
        // the number of headers.
        continue;
      }
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key.get(), value);
      headers.setCopy(key, value);
    }
  }

  if (!response_headers_to_add_if_absent_.empty()) {
    for (const auto& [key, value] : response_headers_to_add_if_absent_) {
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key.get(), value);
      if (auto header_entry = headers.get(key); header_entry.empty()) {
        if (headers.size() >= headers.maxHeadersCount()) {
          omitted_response_headers = true;
          break;
        }
        ENVOY_STREAM_LOG(trace, "ext_authz filter added header(s) to the encoded response:",
                         *encoder_callbacks_);
        headers.addCopy(key, value);
      }
    }
  }

  if (!response_headers_to_overwrite_if_exists_.empty()) {
    for (const auto& [key, value] : response_headers_to_overwrite_if_exists_) {
      ENVOY_STREAM_LOG(trace, "'{}':'{}'", *encoder_callbacks_, key, value);
      if (auto header_entry = headers.get(key); !header_entry.empty()) {
        ENVOY_STREAM_LOG(
            trace, "ext_authz filter set header(s) to the encoded response:", *encoder_callbacks_);
        headers.setCopy(key, value);
      }
    }
  }