feat: rewrite hmac-auth plugin for usability#11581
Conversation
dosubot
Bot
added
size:XXL
|
bad title, we can not use pls add more description about why we need this PR? |
Revolyssup
changed the title
Revolyssup
changed the title
done |
membphis
left a comment
membphis
left a comment
There was a problem hiding this comment.
LGTM, except some minor issues
| date = auth_data[5] | ||
| signed_headers = auth_data[6] | ||
| end | ||
| if not auth_string:match("^Signature") then |
There was a problem hiding this comment.
a high performance way: core.string.has_prefix
There was a problem hiding this comment.
|
|
||
| local consumer_conf = consumer.plugin(plugin_name) | ||
| consumer.attach_consumer(ctx, validated_consumer, consumer_conf) | ||
| core.log.info("hit hmac-auth rewrite") |
5793e98
|
What was the reason for changing the property name from 'access_key' to 'key_id'? |
|
Why is this completely incompatible update not opening a new plugin? Or compatible with the previous usage method? Have you not considered us users? Do you want us to remain on one version? Not to update? |
|
Maybe we can rename this newly hmac-auth as hmac-auth-v2? Since hmac-auth is widely used in many different users' prod environment, this breaking change will rise many problems. There're many different consumers that use hmac-auth, it's impossible to have them adopt the new hmac sign algorithm, which means we have to keep the old hmac-auth plugin, thus we only have two choices: donnot upgrade apisix or remove this change in my fork version. Neither is good way. |
7 participants
Currently the hmac-auth plugin has a lot of headers that need to be configured, which makes it confusing to use the plugin. This PR also makes it so that it follows the RFC.
This PR refactors the plugin as following:
Authorizationheader instead of multiple headers for ease of use. Now you can provide 4 parameters(key_id,signature, headers,algorithm) in Authorization header separated by comma in any order, this makes it easy to use@Request-target definition comes from: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures-03#name-request-target
Signing string generation logic: https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-00#section-2.1.2