You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The hmac-auth plugin reads the entire client request body into memory to verify the digest when validate_request_body is true. Today that read (core.request.get_body()) has no upper bound, so a client can force a worker to buffer an arbitrarily large body. The only existing backstop is the global nginx client_max_body_size, which operators routinely raise or disable for upload routes.
This adds a max_req_body_size option (integer, default 67108864 = 64 MiB, minimum 1) to hmac-auth, so that when body validation is enabled, oversized requests are rejected with 413 before the body is buffered:
hmac-auth: caps the body read for digest validation (passed to core.request.get_body()); enforced only on the validate_request_body = true path.
This complements the body-size hardening series started in #13466, which added max_req_body_size to forward-auth, ai-proxy, and ai-proxy-multi. That PR deliberately excluded hmac-auth; this PR closes that gap with the same default, the same 413 rejection behavior, and the same schema/docs conventions.
Docs and e2e tests are included.
⚠️ Default behavior change
hmac-auth now defaults max_req_body_size to 64 MiB. The change is observable only when all of the following hold:
the route uses hmac-auth with validate_request_body = true; and
the operator has raised nginx client_max_body_size above 64 MiB (or set it to 0); and
a client sends a request body larger than 64 MiB.
In that case the request is now rejected with 413 instead of being buffered in full. Under the default client_max_body_size (1 MiB) there is no change. The limit is configurable via max_req_body_size to restore prior behavior.
Which issue(s) this PR fixes:
Fixes #
Checklist
I have explained the need for this PR and the problem it solves
I have explained the changes or the new features added to this PR
I have added tests corresponding to this change
I have updated the documentation to reflect this change
I have verified that this change is backward compatible (see the documented default behavior change above; configurable via max_req_body_size)
One test needs to be updated before merge. This PR adds max_req_body_size to the hmac-auth route/service schema, but t/plugin/hmac-auth2.t still asserts the exact old response body for /apisix/admin/schema/plugins/hmac-auth. Once the admin schema includes the new property, that test should fail deterministically.
Please update the expected schema JSON, or narrow the assertion to the relevant schema fields, so it includes the new max_req_body_size property.
hmac-auth2.t TEST 2 isn't an exact-match assertion. test_admin.test uses com_tab, which only checks the expected pattern is a subset of the response, ignoring extra keys. The expected JSON already omits signed_headers.default, realm, and anonymous_consumer and still passes. max_req_body_size is just another un-asserted extra key, so the test stays green — confirmed by the passing t/plugin/[a-k]*.t CI job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dosubot
Bot
added
size:L
Description
The
hmac-authplugin reads the entire client request body into memory to verify the digest whenvalidate_request_bodyistrue. Today that read (core.request.get_body()) has no upper bound, so a client can force a worker to buffer an arbitrarily large body. The only existing backstop is the global nginxclient_max_body_size, which operators routinely raise or disable for upload routes.This adds a
max_req_body_sizeoption (integer, default67108864= 64 MiB, minimum1) tohmac-auth, so that when body validation is enabled, oversized requests are rejected with413before the body is buffered:hmac-auth: caps the body read for digest validation (passed tocore.request.get_body()); enforced only on thevalidate_request_body = truepath.This complements the body-size hardening series started in #13466, which added
max_req_body_sizetoforward-auth,ai-proxy, andai-proxy-multi. That PR deliberately excludedhmac-auth; this PR closes that gap with the same default, the same413rejection behavior, and the same schema/docs conventions.Docs and e2e tests are included.
hmac-authnow defaultsmax_req_body_sizeto 64 MiB. The change is observable only when all of the following hold:hmac-authwithvalidate_request_body = true; andclient_max_body_sizeabove 64 MiB (or set it to0); andIn that case the request is now rejected with
413instead of being buffered in full. Under the defaultclient_max_body_size(1 MiB) there is no change. The limit is configurable viamax_req_body_sizeto restore prior behavior.Which issue(s) this PR fixes:
Fixes #
Checklist
max_req_body_size)