feat: add support for extra_headers in forward-auth plugin#12405
Merged
Revolyssup merged 22 commits intoJul 14, 2025
Conversation
dosubot
Bot
added
size:L
kayx23
reviewed
Jul 7, 2025
Co-authored-by: Traky Deng <[email protected]>
nic-6443
reviewed
Jul 8, 2025
nic-6443
reviewed
Jul 8, 2025
kayx23
reviewed
Jul 8, 2025
kayx23
reviewed
Jul 8, 2025
| When the decision is to be made on the basis of POST body, then it is recommended to use `$post_arg.xyz` with `extra_headers` field and make the decision on Authorization service on basis of headers rather than using POST `request_method` to pass the entire request body to Authorization service. | ||
| ::: | ||
|
|
||
| Create a serverless function on the `/auth` route that checks for the presence of the `tenant_id` header. If present, the route responds with HTTP 200 and sets the `X-User-ID` header to a fixed value `i-am-an-user`. If `tenant_id` is missing, it returns HTTP 400 with an error message. |
Member
There was a problem hiding this comment.
Untranslated English content in chinese doc
Co-authored-by: Traky Deng <[email protected]>
kayx23
reviewed
Jul 9, 2025
Co-authored-by: Traky Deng <[email protected]>
…/apisix into revolyssup/forward-auth-fix-2
nic-6443
previously approved these changes
Jul 9, 2025
membphis
reviewed
Jul 10, 2025
Member
|
No additional comments for docs. |
nic-6443
previously approved these changes
Jul 11, 2025
bzp2010
reviewed
Jul 14, 2025
Comment on lines
+128
to
+130
| if not err and n_resolved > 0 then | ||
| auth_headers[header] = resolve_value | ||
| end |
Contributor
There was a problem hiding this comment.
This basically says that the value itself is only rewritten when the variable substitution succeeds, which may not be necessary?
Contributor
Author
There was a problem hiding this comment.
I have modified to only skip in case of error.
When the value is not of type variable(doesn't contain $), it will still be added to auth headers.
Added one more test case to confirm it.
membphis
previously approved these changes
Jul 14, 2025
| auth_headers[header] = resolve_value | ||
| end | ||
| if err then | ||
| core.log.error("failed to resolve variable in extra header '", header, "': ", err) |
Member
There was a problem hiding this comment.
another question: I think we should print the value, it is important information for user
bzp2010
reviewed
Jul 14, 2025
bzp2010
left a comment
bzp2010
left a comment
Contributor
There was a problem hiding this comment.
Your checklist mentions that it is not compatible? Can you reconfirm this?
Contributor
Author
Oh this is compatible. Missed the last check. Fixed it. |
bzp2010
approved these changes
Jul 14, 2025
nic-6443
approved these changes
Jul 14, 2025
membphis
approved these changes
Jul 14, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A follow up for - #12404. The root cause is explained in the revert PR.
With the new solution:
Do not need to pass the whole request body to the auth service and extract data from body into headers and then forward to the auth service. The headers to be extracted will be specified with a new field: extra_headers
Fixes #11200
Checklist