Current Behavior
If a plugin is missing / not enabled, the section is ignored.
Expected Behavior
Apisix should refuse operation for that specific route, since the configuration is not intact
This is a possible security pitfall. In the example below, Apisix simply passed through traffic without user authentication.
Error Logs
No response
Steps to Reproduce
apisix docker image version 3.12.0-debian standalone mode (configuration via yaml file)
setup without openid-connect plugin enabled in config.yaml:
apisix:
enable_admin: false
node_listen: 9080 # APISIX listening port
enable_ipv6: true
ssl:
listen:
- port: 9443
enable_control: true
control:
ip: "127.0.0.1"
deployment:
role: data_plane
role_data_plane:
config_provider: yaml
plugins:
- redirect
- serverless-pre-function
route like this in apisix.yaml:
routes:
- id: 1
hosts:
- my.domain.net
uri: /*
plugins:
openid-connect:
client_id: ...
client_secret: ....
discovery: ....
scope: openid email
bearer_only: false
realm: ....
upstream:
type: roundrobin
nodes:
"httpbin.org": 1
Environment
- APISIX version (run
apisix version): 3.12.0-debian
Current Behavior
If a plugin is missing / not enabled, the section is ignored.
Expected Behavior
Apisix should refuse operation for that specific route, since the configuration is not intact
This is a possible security pitfall. In the example below, Apisix simply passed through traffic without user authentication.
Error Logs
No response
Steps to Reproduce
apisix docker image version 3.12.0-debian standalone mode (configuration via yaml file)
setup without openid-connect plugin enabled in
config.yaml:route like this in
apisix.yaml:Environment
apisix version): 3.12.0-debian