shreemaan-abhishek opened a new pull request, #13696: URL: https://github.com/apache/apisix/pull/13696
### Description The `wolf-rbac` plugin injects `X-UserId` / `X-Username` / `X-Nickname` upstream headers from the auth server's `userInfo`, but only inside the `if type(res.userInfo) == 'table'` guard. When the access-check backend authorizes a request (HTTP 200) without returning `userInfo`, that block is skipped and any client-supplied `X-UserId` / `X-Username` / `X-Nickname` headers reach the upstream unchanged. This aligns `wolf-rbac` with the other auth plugins (`forward-auth`, `opa`, `openid-connect`, `dingtalk-auth`, `feishu-auth`), which already clear these client-supplied identity headers unconditionally before applying the auth response. The plugin now drops the three headers before the `userInfo` gate, so the happy path still overwrites them from `userInfo` and the no-`userInfo` path no longer forwards client values. #### Which issue(s) this PR fixes: Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
