Skip to content

feat: As a user, I want to hide credentials for jwt-auth plugin, so that we wouldn't get jwt token at upstream #8122

Description

@starsz

Description

Hello, I found that now those auth plugins had support "hide_credentials"

plugin field url
key-auth hide_credentials https://apisix.apache.org/docs/apisix/next/plugins/key-auth/
basic-auth hide-credentials https://apisix.apache.org/docs/apisix/next/plugins/basic-auth/
hmac-auth keep_headers https://apisix.apache.org/docs/apisix/next/plugins/hmac-auth/

But jwt-auth plugin doesn't support hiding credentials so we will get the credentials at upstream. It may cause some security problems. I think we should support it.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions