shreemaan-abhishek opened a new pull request, #2813: URL: https://github.com/apache/apisix-ingress-controller/pull/2813
## What this PR does When the `enable-csrf: "true"` annotation is set but the `csrf-key` annotation is missing or empty, `csrf.Handle` returned `(nil, nil)` in `internal/adc/translator/annotations/plugins/csrf.go` - indistinguishable from the annotation being absent. The result: the route is programmed **without** the csrf plugin, the Ingress reconciles cleanly, and an endpoint the operator believed was CSRF-protected runs unprotected, with no error, event, or log. ## Fix Return an error when `enable-csrf` is enabled but `csrf-key` is missing/empty. The plugin parser already logs handler errors at error level (`plugins.go`), so the misconfiguration is now surfaced loudly instead of silently dropping a security-relevant plugin. The error message does not echo the key value. The handler interface doc already states callers should "judge whether Handle is failed by the second error value", so this aligns the csrf handler with the intended contract. ## Test Updated `TestCSRFHandler` to assert that both the missing-key and empty-key cases now return an error. ``` go test ./internal/adc/translator/annotations/plugins/ -run TestCSRFHandler ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
