This is an automated email from the ASF dual-hosted git repository.
guoqqqi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new a135515b08 docs(proxy-cache): clarify that the remote_user isolation
fallback is unverified (#14115)
a135515b08 is described below
commit a135515b085994ab79440426674b2a7443c19fcc
Author: Shreemaan Abhishek <[email protected]>
AuthorDate: Fri Oct 30 08:35:35 2026 +0800
docs(proxy-cache): clarify that the remote_user isolation fallback is
unverified (#14115)
---
docs/en/latest/plugins/proxy-cache.md | 2 ++
docs/zh/latest/plugins/proxy-cache.md | 2 ++
2 files changed, 4 insertions(+)
diff --git a/docs/en/latest/plugins/proxy-cache.md
b/docs/en/latest/plugins/proxy-cache.md
index e43142a315..60587d91d4 100644
--- a/docs/en/latest/plugins/proxy-cache.md
+++ b/docs/en/latest/plugins/proxy-cache.md
@@ -61,6 +61,8 @@ The plugin always honors upstream `Cache-Control: private`,
`no-store`, and `no-
Both caching strategies honor the upstream `Vary` response header (RFC 9111
§4.1). Cache entries are partitioned by the request's values for each header
listed in `Vary`, so a response served with `Vary: Accept-Encoding` will not be
served to a request with a different `Accept-Encoding`. Responses with `Vary:
*` are treated as not reusable and are not cached.
+The `consumer_isolation` fallback to `$remote_user` does not verify
credentials. NGINX parses `$remote_user` from the client's `Authorization:
Basic` header as-is, so any client can claim any username. Do not rely on this
fallback to protect personalized cached responses. Configure an authentication
plugin on the route so the identity resolves to a verified APISIX consumer, or
disable caching for routes that return per-user content.
+
## Static Configurations
By default, values such as `cache_ttl` when caching on disk and cache `zones`
are pre-configured in the [default
configuration](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua).
diff --git a/docs/zh/latest/plugins/proxy-cache.md
b/docs/zh/latest/plugins/proxy-cache.md
index a0ff0111f2..c8c3ae37a1 100644
--- a/docs/zh/latest/plugins/proxy-cache.md
+++ b/docs/zh/latest/plugins/proxy-cache.md
@@ -60,6 +60,8 @@ import TabItem from '@theme/TabItem';
两种缓存策略都会遵循上游响应中的 `Vary` 响应头（RFC 9111 §4.1）。缓存条目会按请求中 `Vary`
列出的各个头部的值进行分区，因此一个带有 `Vary: Accept-Encoding` 的响应不会被返回给具有不同 `Accept-Encoding`
的请求。`Vary: *` 的响应被视为不可复用，不会被缓存。
+`consumer_isolation` 回退使用的 `$remote_user` 不会校验凭证。NGINX 直接从客户端的 `Authorization:
Basic` 请求头中解析
`$remote_user`，因此任何客户端都可以声称任意用户名。不要依赖该回退来保护个性化的缓存响应。请在路由上配置认证插件，使身份解析为经过校验的
APISIX 消费者，或对返回用户专属内容的路由关闭缓存。
+
## 静态配置
默认情况下，磁盘缓存时的 `cache_ttl` 和缓存 `zones` 等值已在
[默认配置](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua)
中预先配置。
