Kusk Gateway Auth Not Enforced

You encounter a kusk configuration issue that prevents your workflow from completing. This guide walks through the fix step by step.

Wrong ❌

x-envoy-auth: { type: apiKey } # Missing name or in specification

Wrong Output

Auth middleware configured but never enforced. All requests pass without auth.

Right ✅

openapi: "3.0.3"
info: { title: Secure API, version: "1.0.0" }
components:
  securitySchemes:
    ApiKeyAuth: { type: apiKey, in: header, name: X-API-Key }
paths:
  /users:
    get:
      security: [ApiKeyAuth: []]
      responses: { "200": { description: OK } }
x-envoy-auth: { type: apiKey, header: X-API-Key, keys: [{ name: default, value: ${API_KEY} }] }

Right Output

Unauthenticated requests return 401. Valid X-API-Key header succeeds. Auth enforced.

Prevention

• Define securitySchemes in OpenAPI components.
• Apply security to specific paths.
• Configure x-envoy-auth with matching header name.
• Store keys in K8s secrets.
• Test with and without credentials.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with gateway auth

1. Non-exhaustive pattern matches that compile with warnings then crash at runtime
2. Misunderstanding that String is [Char] with poor performance for large text operations
3. Using foldl instead of foldl' causing stack overflow on large lists

These mistakes appear frequently in real-world KUSK code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.