AlinsRan commented on PR #13840: URL: https://github.com/apache/apisix/pull/13840#issuecomment-5350866594
Confirmed, and fixed in `67b72e57`. Both halves reproduce from the code: - `build_headers` forwarded the caller's `Authorization` (or every downstream header under `pass_all_downstream_headers`), while `schema_cache` / `failure_cache` are keyed by `conf.introspection_endpoint or ctx.service_id` — no identity dimension. - `fetch_schema` treats any non-200 as an error, and `fetch_and_cache` stores it under that same key for 10s. So one request whose credentials the upstream rejects answers 400 to every other caller on that worker until it expires. That is the more serious half: it needs no schema variation at all, only a bad token. I did not take the second option you offered. Keying the cache by identity makes the key space the token space, and it would still leave each identity able to poison its own entry. The design's granularity is the service — decorations and the quota both are — so the introspection has to be identity-independent to match. `pass_all_downstream_headers` is therefore gone and nothing is taken from the request. `introspection_headers` replaces it: operator-supplied headers sent verbatim, applied after `Content-Type`/`Host` so an upstream needing different ones can have them. The plugin is unreleased, so there is no compatibility to keep. Tests: - a case reaching `build_headers` through the shipped module's upvalues, asserting that a caller sending `Authorization` and `Cookie` contributes neither, and that configured headers do arrive. Restoring the forwarding reddens it. - an end-to-end pair against a new fixture upstream that 401s introspection without `Bearer operator-token`: the first request sends that exact token as the **client's** own `Authorization` and still gets 400 with `unexpected status 401` in the log — which is the proof it is not forwarded — and the second succeeds once the same value is configured as `introspection_headers`. On the "outside the request path" part: with credentials now static, prefetching becomes possible, but it still needs a `/services`-watcher-driven registry and a refresher timer. That is the P2 (1) I said I would track separately, and this fix does not depend on it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
