bhuvan-somisetty commented on PR #14057: URL: https://github.com/apache/apisix/pull/14057#issuecomment-6316166256
Thanks for the review and catching those! I've updated the test to mock `scheme` in `api_ctx.var._cache` (avoiding the write to `ngx.var.scheme`) and ran `reindex` across the test file. Regarding the live TLS handshake path: as you noted, OpenResty/Nginx will reject unknown SNIs during ClientHello before reaching access phase when strict TLS termination is in effect. The nil dereference occurs in custom or embedded deployments where SSL termination or handshake bypass allows the access phase to run over HTTPS without an APISIX SSL entity populating `ngx.ctx.matched_ssl`. Having this defensive guard ensures `verify_https_client()` safely skips the route-level skip-mTLS checks in those environments just like the host matching check below it does. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
