AlinsRan commented on code in PR #13649:
URL: https://github.com/apache/apisix/pull/13649#discussion_r3708716580
##########
apisix-master-0.rockspec:
##########
@@ -51,7 +51,7 @@ dependencies = {
"opentracing-openresty = 0.1-0",
"lua-resty-radixtree = 2.9.2-0",
"lua-protobuf = 0.5.3-1",
- "lua-resty-openidc = 1.8.0-1",
+ "lua-resty-openidc = 1.9.0-1",
Review Comment:
One addition here: this is testable without a live OP, which would keep the
behavior from changing again unnoticed. A mock introspection endpoint that
reports whether the credentials arrived in the POST body or in the
`Authorization` header, driven through a `bearer_only` route, pins all three
cases:
```
introspection_endpoint_auth_method unset -> body=false header=true
introspection_endpoint_auth_method basic -> body=false header=true
introspection_endpoint_auth_method post -> body=true header=false
```
The first line is the one that matters: it is `false` only because the
schema default injects `client_secret_basic` before the conf reaches the
library. Removing that default flips it to `body=true header=false`, which is
the 1.8.0 behavior — so the test fails exactly when this interaction changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
