Agree, Or we can only accept a fixed token when `apisix.enable_dev_mode = true`, which needs to be enabled manually. Otherwise, we should generate a new token instead.
Leslie Tsang leslie.ts...@icloud.com > On 26 Jan 2022, at 11:06 AM, Zeping Bai <bzp2...@apache.org> wrote: > > Agree to a scheme that removes fixed tokens and generates random tokens at > startup. > > Best regards! > Zeping Bai @bzp2010 > > Ming Wen <wenm...@apache.org> 于2022年1月25日周二 16:28写道： > >> hello, >> Apache APISIX has the fixed token of admin API in the configuration >> file[1]. >> While we strongly recommend that users change this token, this is a >> security risk anyway. We should use a more elegant solution to actively >> solve this problem. >> >> My solution is: >> 1. Remove these fixed tokens and change the default value to empty >> 2. When Apache APISIX starts, if the token is found to be empty, it >> will automatically generate a random token, and print the hint information >> on the screen and in the log: random token is only applicable to the test >> environment, please use a custom token in the generation environment and >> write into the configuration file. >> 3. The admin API does not accept the empty token. >> >> In this way, it will not affect the previous version, nor will it >> affect the developer's experience of Apache APISIX, and enhance the >> security. >> >> What do you think? >> >> >> [1] >> >> https://github.com/apache/apisix/blob/master/conf/config-default.yaml#L87-L100 >> >> Thanks, >> Ming Wen, Apache APISIX PMC Chair >> Twitter: _WenMing >>
