Skip to content

Commit e7c7c6d

Browse files
RevolyssupRevolyssup
authored
fix(forward-auth): extra_headers not resolving variable on $post_arg. (#12435)
1 parent 8e5f240 commit e7c7c6d

File tree

4 files changed

+56
-40
lines changed

4 files changed

+56
-40
lines changed

‎apisix/core/utils.lua‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ local resolve_var
295295
do
296296
local _ctx
297297
local n_resolved
298-
local pat = [[(?<!\\)\$(\{(\w+)\}|(\w+))]]
298+
local pat = [[(?<!\\)\$(\{([\w\.]+)\}|([\w\.]+))]]
299299
local _escaper
300300

301301
local function resolve(m)

‎docs/en/latest/plugins/forward-auth.md‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ Location: http://example.com/auth
173173
When the decision is to be made on the basis of POST body, then it is recommended to use `$post_arg.*` with `extra_headers` field and make the decision on Authorization service on basis of headers rather than using POST `request_method` to pass the entire request body to Authorization service.
174174
:::
175175

176-
Create a serverless function on the `/auth` route that checks for the presence of the `tenant_id` header. If present, the route responds with HTTP 200 and sets the `X-User-ID` header to a fixed value `i-am-an-user`. If `tenant_id` is missing, it returns HTTP 400 with an error message.
176+
Create a serverless function on the `/auth` route that checks for the presence of the `tenant_id` header and confirms its value. If present, the route responds with HTTP 200.. If `tenant_id` is missing, it returns HTTP 400 with an error message.
177177

178178
```shell
179179
curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/auth' \
@@ -187,11 +187,12 @@ curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/auth' \
187187
"functions": [
188188
"return function(conf, ctx)
189189
local core = require(\"apisix.core\")
190-
if core.request.header(ctx, \"tenant_id\") then
190+
local tenant_id = core.request.header(ctx, \"tenant_id\")
191+
if tenant_id == \"123\" then
191192
core.response.set_header(\"X-User-ID\", \"i-am-an-user\");
192193
core.response.exit(200);
193194
else
194-
core.response.exit(400, \"tenant_id is required\")
195+
core.response.exit(400, \"tenant_id is \"..tenant_id .. \" but expected 123\");
195196
end
196197
end"
197198
]
@@ -227,8 +228,8 @@ curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/1' \
227228
Send a POST request with the `tenant_id` header:
228229

229230
```shell
230-
curl -i http://127.0.0.1:9080/post -X POST -d '{
231-
"tenant_id": 123
231+
curl -i http://127.0.0.1:9080/post -H "Content-Type: application/json" -X POST -d '{
232+
"tenant_id": "123"
232233
}'
233234
```
234235

@@ -237,38 +238,38 @@ You should receive an `HTTP/1.1 200 OK` response similar to the following:
237238
```json
238239
{
239240
"args": {},
240-
"data": "",
241+
"data": "{\n \"tenant_id\": \"123\"\n}",
241242
"files": {},
242-
"form": {
243-
"{\n \"tenant_id\": 123\n}": ""
244-
},
243+
"form": {},
245244
"headers": {
246245
"Accept": "*/*",
247-
"Content-Length": "23",
248-
"Content-Type": "application/x-www-form-urlencoded",
246+
"Content-Length": "25",
247+
"Content-Type": "application/json",
249248
"Host": "127.0.0.1",
250249
"User-Agent": "curl/8.13.0",
251-
"X-Amzn-Trace-Id": "Root=1-686b6e3f-2fdeff70183e71551f5c5729",
250+
"X-Amzn-Trace-Id": "Root=1-687775d8-6890073173b30c2834901e8b",
252251
"X-Forwarded-Host": "127.0.0.1"
253252
},
254-
"json": null,
255-
"origin": "127.0.0.1, 106.215.83.33",
253+
"json": {
254+
"tenant_id": "123"
255+
},
256+
"origin": "127.0.0.1, 106.215.82.114",
256257
"url": "http://127.0.0.1/post"
257258
}
258259
```
259260

260-
Send a POST request without the `tenant_id` header:
261+
Send a POST request with wrong the `tenant_id` header:
261262

262263
```shell
263-
curl -i http://127.0.0.1:9080/post -X POST -d '{
264-
"abc": 123
264+
curl -i http://127.0.0.1:9080/post -H "Content-Type: application/json" -X POST -d '{
265+
"tenant_id": "asdfasd"
265266
}'
266267
```
267268

268269
You should receive an `HTTP/1.1 400 Bad Request` response with the following message:
269270

270271
```shell
271-
tenant_id is required
272+
tenant_id is asdfasd but expected 123
272273
```
273274

274275
## Delete Plugin

‎docs/zh/latest/plugins/forward-auth.md‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -189,11 +189,12 @@ curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/auth' \
189189
"functions": [
190190
"return function(conf, ctx)
191191
local core = require(\"apisix.core\")
192-
if core.request.header(ctx, \"tenant_id\") then
192+
local tenant_id = core.request.header(ctx, \"tenant_id\")
193+
if tenant_id == \"123\" then
193194
core.response.set_header(\"X-User-ID\", \"i-am-an-user\");
194195
core.response.exit(200);
195196
else
196-
core.response.exit(400, \"tenant_id is required\")
197+
core.response.exit(400, \"tenant_id is \"..tenant_id .. \" but expected 123\");
197198
end
198199
end"
199200
]
@@ -202,7 +203,7 @@ curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/auth' \
202203
}'
203204
```
204205

205-
创建一个接受 POST 请求的路由，并使用 `forward-auth` 插件通过请求中的 `tenant_id` 调用身份验证端点。只有当身份验证检查返回 200 时，请求才会转发到上游服务。
206+
创建一个接受 POST 请求的路由，并使用 `forward-auth` 插件通过请求中的 `tenant_id` 调用身份验证端点。仅当身份验证检查返回 200 时，请求才会转发到上游服务。
206207

207208
```shell
208209
curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/1' \
@@ -229,8 +230,8 @@ curl -X PUT 'http://127.0.0.1:9180/apisix/admin/routes/1' \
229230
发送带有 `tenant_id` 标头的 POST 请求：
230231

231232
```shell
232-
curl -i http://127.0.0.1:9080/post -X POST -d '{
233-
"tenant_id": 123
233+
curl -i http://127.0.0.1:9080/post -H "Content-Type: application/json" -X POST -d '{
234+
"tenant_id": "123"
234235
}'
235236
```
236237

@@ -239,38 +240,38 @@ curl -i http://127.0.0.1:9080/post -X POST -d '{
239240
```json
240241
{
241242
"args": {},
242-
"data": "",
243+
"data": "{\n \"tenant_id\": \"123\"\n}",
243244
"files": {},
244-
"form": {
245-
"{\n \"tenant_id\": 123\n}": ""
246-
},
245+
"form": {},
247246
"headers": {
248247
"Accept": "*/*",
249-
"Content-Length": "23",
250-
"Content-Type": "application/x-www-form-urlencoded",
248+
"Content-Length": "25",
249+
"Content-Type": "application/json",
251250
"Host": "127.0.0.1",
252251
"User-Agent": "curl/8.13.0",
253-
"X-Amzn-Trace-Id": "Root=1-686b6e3f-2fdeff70183e71551f5c5729",
252+
"X-Amzn-Trace-Id": "Root=1-687775d8-6890073173b30c2834901e8b",
254253
"X-Forwarded-Host": "127.0.0.1"
255254
},
256-
"json": null,
257-
"origin": "127.0.0.1, 106.215.83.33",
255+
"json": {
256+
"tenant_id": "123"
257+
},
258+
"origin": "127.0.0.1, 106.215.82.114",
258259
"url": "http://127.0.0.1/post"
259260
}
260261
```
261262

262-
发送不带 `tenant_id` 标头的 POST 请求：
263+
发送带有错误 `tenant_id` 标头的 POST 请求：
263264

264265
```shell
265-
curl -i http://127.0.0.1:9080/post -X POST -d '{
266-
"abc": 123
266+
curl -i http://127.0.0.1:9080/post -H "Content-Type: application/json" -X POST -d '{
267+
"tenant_id": "asdfasd"
267268
}'
268269
```
269270

270271
您应该收到包含以下消息的 `HTTP/1.1 400 Bad Request` 响应：
271272

272273
```shell
273-
tenant_id is required
274+
tenant_id is asdfasd but expected 123
274275
```
275276

276277
## 删除插件

‎t/plugin/forward-auth.t‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,11 +112,24 @@ property "request_method" validation failed: matches none of the enum values
112112
[[return function(conf, ctx)
113113
local core = require("apisix.core");
114114
if core.request.header(ctx, "Authorization") == "777" then
115-
if core.request.header(ctx, "tenant_id") then
115+
local tenant_id = core.request.header(ctx, "tenant_id")
116+
if tenant_id == "123" then
116117
core.response.set_header("X-User-ID", "i-am-an-user");
117118
core.response.exit(200);
118119
else
119-
core.response.exit(400, "tenant_id is required");
120+
core.response.exit(400, "tenant_id is "..tenant_id);
121+
end
122+
end
123+
end]],
124+
[[return function(conf, ctx)
125+
local core = require("apisix.core");
126+
if core.request.header(ctx, "Authorization") == "888" then
127+
local tenant_id = core.request.header(ctx, "tenant_id")
128+
if tenant_id == "abcd" then
129+
core.response.set_header("X-User-ID", "i-am-an-user");
130+
core.response.exit(200);
131+
else
132+
core.response.exit(400, "tenant_id is "..tenant_id);
120133
end
121134
end
122135
end]],
@@ -463,6 +476,7 @@ POST /ping2
463476
{"tenant_id": 123}
464477
--- more_headers
465478
Authorization: 777
479+
Content-Type: application/json
466480
--- response_body_like eval
467481
qr/\"x-user-id\":\"i-am-an-user\"/
468482
@@ -472,6 +486,6 @@ qr/\"x-user-id\":\"i-am-an-user\"/
472486
--- request
473487
GET /ping3
474488
--- more_headers
475-
Authorization: 777
489+
Authorization: 888
476490
--- response_body_like eval
477491
qr/\"x-user-id\":\"i-am-an-user\"/

0 commit comments

Comments
 (0)