mikyll opened a new issue, #11435: URL: https://github.com/apache/apisix/issues/11435
### Current Behavior When I configure a route with [`multi-auth`](https://apisix.apache.org/docs/apisix/plugins/multi-auth/) plugin and don't set `conf.header` value **_explicitly_**, the plugin breaks and returns `500 Internal Server Error`: ```html <html> <head><title>500 Internal Server Error</title></head> <body> <center><h1>500 Internal Server Error</h1></center> <hr><center>openresty</center> <p><em>Powered by <a href="https://apisix.apache.org/";>APISIX</a>.</em></p></body> </html> ``` ### Expected Behavior I expect to obtain the classic response `401 Unauthorized`: ```json {"message":"Missing API key found in request"} ``` ### Error Logs ```lang-none 2024/07/25 12:18:47 [error] 75#75: *522943 lua entry thread aborted: runtime error: /usr/local/openresty/lualib/resty/core/request.lua:118: bad argument #1 to 'lower' (string expected, got nil) stack traceback: coroutine 0: [C]: in function 'lower' /usr/local/openresty/lualib/resty/core/request.lua:118: in function '__index' /home/apisix/apisix_src/apisix/core/request.lua:110: in function 'header' /home/apisix/apisix_src/apisix/plugins/key-auth.lua:71: in function 'rewrite' /home/apisix/apisix_src/apisix/plugins/multi-auth.lua:71: in function 'phase_func' /home/apisix/apisix_src/apisix/plugin.lua:1155: in function 'run_plugin' /home/apisix/apisix_src/apisix/init.lua:696: in function 'http_access_phase' access_by_lua(nginx.conf:319):2: in main chunk, client: ::1, server: _, request: "GET /httpbin/test/multi-auth/test1/ HTTP/1.1", host: "localhost:9080" ``` ### Steps to Reproduce ### `multi-auth` Example Setup the multi-auth test routes: ```bash # With multi-auth and conf.header default value curl -s -X PUT "http://127.0.0.1:9180/apisix/admin/routes/3"; -d ' { "uris": [ "/httpbin/test/multi-auth/test1/*" ], "upstream": { "type": "roundrobin", "nodes": { "httpbin:80": 1 } }, "plugins": { "proxy-rewrite": { "regex_uri": [ "^/httpbin/test/multi-auth/test1/(.*)", "/get" ], "method": "GET" }, "multi-auth":{ "auth_plugins":[ { "basic-auth": {} }, { "key-auth": { "hide_credentials":true } } ] } } } ' # With multi-auth and conf.header custom value curl -s -X PUT "http://127.0.0.1:9180/apisix/admin/routes/4"; -d ' { "uris": [ "/httpbin/test/multi-auth/test2/*" ], "upstream": { "type": "roundrobin", "nodes": { "httpbin:80": 1 } }, "plugins": { "proxy-rewrite": { "regex_uri": [ "^/httpbin/test/multi-auth/test2/(.*)", "/get" ], "method": "GET" }, "multi-auth":{ "auth_plugins":[ { "basic-auth": {} }, { "key-auth": { "hide_credentials":true, "header":"apikey" } } ] } } } ' ``` Test: ```bash curl -s -i "http://localhost:9080/httpbin/test/multi-auth/test1/"; # This gives 500 Internal Server Error (see log message) curl -s -i "http://localhost:9080/httpbin/test/multi-auth/test2/"; # This works ``` ### `key-auth` Example With simple `key-auth` plugin it works just fine: ```bash # With key-auth and conf.header default value curl -s -X PUT "http://127.0.0.1:9180/apisix/admin/routes/1"; -d ' { "uris": [ "/httpbin/test/key-auth/test1/*" ], "upstream": { "type": "roundrobin", "nodes": { "httpbin.org:80": 1 } }, "plugins": { "proxy-rewrite": { "regex_uri": [ "^/httpbin/test/key-auth/test1/(.*)", "/get" ], "method": "GET" }, "key-auth": { "hide_credentials":true } } } ' # With key-auth and conf.header custom value curl -s -X PUT "http://127.0.0.1:9180/apisix/admin/routes/2"; -d ' { "uris": [ "/httpbin/test/key-auth/test2/*" ], "upstream": { "type": "roundrobin", "nodes": { "httpbin.org:80": 1 } }, "plugins": { "proxy-rewrite": { "regex_uri": [ "^/httpbin/test/key-auth/test2/(.*)", "/get" ], "method": "GET" }, "key-auth": { "hide_credentials":true, "header":"apikey" } } } ' ``` Test: ```bash curl -s -i "http://localhost:9080/httpbin/test/key-auth/test1/"; # This works curl -s -i "http://localhost:9080/httpbin/test/key-auth/test2/"; # This works ``` ### Environment - APISIX version (run `apisix version`): ```lang-none 3.9.1 ``` - Operating system (run `uname -a`): ```lang-none Linux e911f1d22ca2 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64 GNU/Linux (built from source, in custom Docker container, from `debian:bullseye-slim` image) ``` - OpenResty / Nginx version (run `openresty -V` or `nginx -V`): ```lang-none nginx version: openresty/1.25.3.1 built by gcc 10.2.1 20210110 (Debian 10.2.1-6) built with OpenSSL 3.2.0 23 Nov 2023 TLS SNI support enabled configure arguments: --prefix=/usr/local/openresty/nginx --with-debug --with-cc-opt='-DNGX_LUA_USE_ASSERT -DNGX_LUA_ABORT_AT_PANIC -O2 -DAPISIX_RUNTIME_VER=1.2.0 -DNGX_GRPC_CLI_ENGINE_PATH=/usr/local/openresty/libgrpc_engine.so -DNGX_HTTP_GRPC_CLI_ENGINE_PATH=/usr/local/openresty/libgrpc_engine.so -DNGX_LUA_ABORT_AT_PANIC -I/usr/local/openresty/zlib/include -I/usr/local/openresty/pcre/include -I/usr/local/openresty/openssl3/include' --add-module=../ngx_devel_kit-0.3.3 --add-module=../echo-nginx-module-0.63 --add-module=../xss-nginx-module-0.06 --add-module=../ngx_coolkit-0.2 --add-module=../set-misc-nginx-module-0.33 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.09 --add-module=../srcache-nginx-module-0.33 --add-module=../ngx_lua-0.10.26 --add-module=../ngx_lua_upstream-0.07 --add-module=../headers-more-nginx-module-0.37 --add-module=../array-var-nginx-module-0.06 --add-module=../memc-nginx-module-0.20 --add-module=../redis2-nginx- module-0.15 --add-module=../redis-nginx-module-0.3.9 --add-module=../ngx_stream_lua-0.0.14 --with-ld-opt='-Wl,-rpath,/usr/local/openresty/luajit/lib -Wl,-rpath,/usr/local/openresty/wasmtime-c-api/lib -L/usr/local/openresty/zlib/lib -L/usr/local/openresty/pcre/lib -L/usr/local/openresty/openssl3/lib -Wl,-rpath,/usr/local/openresty/zlib/lib:/usr/local/openresty/pcre/lib:/usr/local/openresty/openssl3/lib' --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../mod_dubbo-1.0.2 --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../ngx_multi_upstream_module-1.2.0 --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../apisix-nginx-module-1.16.0 --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../apisix-nginx-module-1.16.0/src/stream --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../apisix-nginx-module-1.16.0/src/meta --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../wasm-nginx-module-0.7.0 --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../lua-var-nginx-module-v0.5.3 --add -module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../grpc-client-nginx-module-v0.5.0 --add-module=/tmp/tmp.PvubYudeuF/openresty-1.25.3.1/../lua-resty-events-0.2.0 --with-poll_module --with-pcre-jit --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_v2_module --with-http_v3_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --with-http_stub_status_module --with-http_realip_module --with-http_addition_module --with-http_auth_request_module --with-http_secure_link_module --with-http_random_index_module --with-http_gzip_static_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-threads --with-compat --with-stream --without-pcre2 --with-http_ssl_module ``` - LuaRocks version, for installation issues (run `luarocks --version`): ```lang-none /usr/local/bin/luarocks 3.8.0 ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
