(apisix) branch master updated: fix(loki-logger): encrypt the headers field (#13784)

[nic443]

This is an automated email from the ASF dual-hosted git repository.

nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git


The following commit(s) were added to refs/heads/master by this push:
     new c05c2ecfec fix(loki-logger): encrypt the headers field (#13784)
c05c2ecfec is described below

commit c05c2ecfecd4c9f53d3cf9afea1963d436fe6d6d
Author: Nic <qiany...@api7.ai>
AuthorDate: Fri Aug 7 14:42:29 2026 +0800

    fix(loki-logger): encrypt the headers field (#13784)
---
 apisix/plugins/loki-logger.lua |  1 +
 t/plugin/loki-logger.t         | 65 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/apisix/plugins/loki-logger.lua b/apisix/plugins/loki-logger.lua
index 4e584a8270..c7eb744f49 100644
--- a/apisix/plugins/loki-logger.lua
+++ b/apisix/plugins/loki-logger.lua
@@ -111,6 +111,7 @@ local schema = {
         max_req_body_bytes = {type = "integer", minimum = 1, default = 524288},
         max_resp_body_bytes = {type = "integer", minimum = 1, default = 
524288},
     },
+    encrypt_fields = {"headers"},
     required = {"endpoint_addrs"}
 }
 
diff --git a/t/plugin/loki-logger.t b/t/plugin/loki-logger.t
index 89d9b4c8fb..ad45b3334b 100644
--- a/t/plugin/loki-logger.t
+++ b/t/plugin/loki-logger.t
@@ -616,3 +616,68 @@ hello world
         }
     }
 --- error_code: 200
+
+
+
+=== TEST 22: data encryption for headers
+--- yaml_config
+apisix:
+    data_encryption:
+        enable_encrypt_fields: true
+        keyring:
+            - edd1c9f0985e76a2
+--- config
+    location /t {
+        content_by_lua_block {
+            local json = require("toolkit.json")
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1', ngx.HTTP_PUT, {
+                uri = "/hello",
+                upstream = {
+                    type = "roundrobin",
+                    nodes = {
+                        ["127.0.0.1:1980"] = 1
+                    }
+                },
+                plugins = {
+                    ["loki-logger"] = {
+                        endpoint_addrs = {"http://127.0.0.1:8199"},
+                        headers = {
+                            Authorization = "Basic ZWxhc3RpYzoxMjM0NTY="
+                        },
+                        batch_max_size = 1,
+                        inactive_timeout = 1
+                    }
+                }
+            })
+
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(body)
+                return
+            end
+            ngx.sleep(0.1)
+
+            -- get plugin conf from admin api, header is decrypted
+            local code, message, res = t('/apisix/admin/routes/1',
+                ngx.HTTP_GET
+            )
+            res = json.decode(res)
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(message)
+                return
+            end
+
+            ngx.say(res.value.plugins["loki-logger"].headers.Authorization)
+
+            -- get plugin conf from etcd, header is encrypted
+            local etcd = require("apisix.core.etcd")
+            local res = assert(etcd.get('/routes/1'))
+            local stored = 
res.body.node.value.plugins["loki-logger"].headers.Authorization
+            ngx.say(stored ~= "Basic ZWxhc3RpYzoxMjM0NTY=" and "encrypted" or 
"plaintext")
+        }
+    }
+--- response_body
+Basic ZWxhc3RpYzoxMjM0NTY=
+encrypted