waterWang opened a new pull request, #13883:
URL: https://github.com/apache/apisix/pull/13883
### Summary
Fixes #13881 — `basic-auth` currently accepts a consumer with an empty
password, allowing passwordless access.
RFC 8265 section 4.1 (the OpaqueString password profile referenced by RFC
7617) requires a password to be non-zero-length. Today the Admin API accepts
`password: ""` because `consumer_schema.password` is declared as plain `{ type
= "string" }` with no `minLength`. Such a consumer authenticates, so it looks
protected while it effectively has no secret. Once #13836 lands (split on the
first colon per RFC 7617), `user:` would also return 200 for such a consumer.
### Changes
- **`apisix/plugins/basic-auth.lua`**
- Add `minLength = 1` to `consumer_schema.password` so the Admin API
rejects empty passwords on consumer create/update.
- Fail closed in `find_consumer` when either the presented or the resolved
password is empty. This also covers existing empty-password consumers and
`$secret://` / `$ENV://` references that resolve to `""`.
- **`t/plugin/basic-auth.t`** — regression tests:
- consumer schema rejects an empty password
- Admin API rejects a consumer with an empty password (400)
- `foo:` (empty password) returns 401
- whitespace-only password (`foo: `) returns 401
### Compatibility with #13836
This change is orthogonal to #13836 (which fixes parsing to split on the
first colon). With or without #13836, an empty/whitespace-only password now
fails closed with a 401.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
