Yilialinn commented on code in PR #2134:
URL: https://github.com/apache/apisix-website/pull/2134#discussion_r4231131325
##########
website/learning-center/api-gateway-security.md:
##########
@@ -116,6 +116,28 @@ For **mutual TLS**, APISIX supports [mTLS
configuration](/docs/apisix/mtls/) for
APISIX also supports JWT authentication, key authentication, OpenID Connect,
rate limiting with multiple algorithms, and request body validation. Its plugin
architecture lets teams compose gateway policies per route while retaining
application-level authorization and validation in the services that own the
data.
+### Example: Authenticate and Rate-Limit a Route
+
+For a protected API, first create a Consumer with a `key-auth` Credential.
Then enable [key-auth](/docs/apisix/plugins/key-auth/) and
[limit-count](/docs/apisix/plugins/limit-count/) on the Route. This example is
a plugin configuration excerpt for a Route that already has an Upstream; adjust
the quota to the backend's capacity and the client contract:
+
+```json
+{
+ "key-auth": {
+ "hide_credentials": true
+ },
+ "limit-count": {
+ "count": 100,
+ "time_window": 60,
+ "rejected_code": 429,
+ "key_type": "var_combination",
+ "key": "$remote_addr $consumer_name",
+ "policy": "local"
+ }
+}
+```
+
+The counter key combines the address APISIX observes and the authenticated
Consumer name, so the quota applies to each pair, not to each Consumer across
all addresses. Behind a proxy, that address may be the proxy's; configure a
[trusted real-IP source](/docs/apisix/plugins/real-ip/) if the quota must use
the original client address. With `policy: local`, each APISIX instance keeps
its own counters; use an appropriate shared Redis policy when a quota must
apply across instances. `hide_credentials` keeps the API key out of the
upstream request. This gateway policy does not decide whether the authenticated
Consumer may access a particular order or account: the application must still
check resource ownership.
Review Comment:
Fixed in 8fb1c0f. The guide now says `hide_credentials` removes only the
header or query parameter used for authentication, warns that a duplicate in
the other carrier can remain, and advises restricting carriers or stripping
alternate copies when strict non-forwarding is required.
##########
website/learning-center/api-gateway-security.md:
##########
@@ -116,6 +116,28 @@ For **mutual TLS**, APISIX supports [mTLS
configuration](/docs/apisix/mtls/) for
APISIX also supports JWT authentication, key authentication, OpenID Connect,
rate limiting with multiple algorithms, and request body validation. Its plugin
architecture lets teams compose gateway policies per route while retaining
application-level authorization and validation in the services that own the
data.
+### Example: Authenticate and Rate-Limit a Route
+
+For a protected API, first create a Consumer with a `key-auth` Credential.
Then enable [key-auth](/docs/apisix/plugins/key-auth/) and
[limit-count](/docs/apisix/plugins/limit-count/) on the Route. This example is
a plugin configuration excerpt for a Route that already has an Upstream; adjust
the quota to the backend's capacity and the client contract:
+
+```json
+{
+ "key-auth": {
+ "hide_credentials": true
+ },
+ "limit-count": {
+ "count": 100,
+ "time_window": 60,
+ "rejected_code": 429,
+ "key_type": "var_combination",
+ "key": "$remote_addr $consumer_name",
Review Comment:
Fixed in 8fb1c0f. The guide now states that this Route uses `key-auth` in
rewrite before `limit-count` in access, and warns to verify `$consumer_name` is
populated if the authentication flow changes. APISIX source sets the Consumer
context during key-auth and reads the combined key in limit-count.
##########
website/learning-center/api-gateway-security.md:
##########
@@ -116,6 +116,28 @@ For **mutual TLS**, APISIX supports [mTLS
configuration](/docs/apisix/mtls/) for
APISIX also supports JWT authentication, key authentication, OpenID Connect,
rate limiting with multiple algorithms, and request body validation. Its plugin
architecture lets teams compose gateway policies per route while retaining
application-level authorization and validation in the services that own the
data.
+### Example: Authenticate and Rate-Limit a Route
+
+For a protected API, first create a Consumer with a `key-auth` Credential.
Then enable [key-auth](/docs/apisix/plugins/key-auth/) and
[limit-count](/docs/apisix/plugins/limit-count/) on the Route. This example is
a plugin configuration excerpt for a Route that already has an Upstream; adjust
the quota to the backend's capacity and the client contract:
+
+```json
+{
+ "key-auth": {
+ "hide_credentials": true
+ },
+ "limit-count": {
+ "count": 100,
+ "time_window": 60,
+ "rejected_code": 429,
+ "key_type": "var_combination",
+ "key": "$remote_addr $consumer_name",
+ "policy": "local"
Review Comment:
Fixed in 8fb1c0f. The text explicitly identifies the JSON as the value of a
Route `plugins` field, not a complete Route object, and names the surrounding
URI and Upstream context.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
