moonming opened a new issue, #14178:
URL: https://github.com/apache/apisix/issues/14178
### Current Behavior
When `deployment.admin.admin_key[].key` comes from an environment variable:
```yaml
deployment:
admin:
admin_key:
- name: admin
key: ${{APISIX_ADMIN_KEY}}
role: admin
```
and the variable contains only digits (for example
`APISIX_ADMIN_KEY=123456`), APISIX starts normally, but every Admin API request
is rejected with 401, including requests that send exactly that key.
The cause is the type conversion in `resolve_conf_var`. After a `${{VAR}}`
substitution, a value that `tonumber()` accepts is converted to a number, and
`true` / `false` are converted to booleans
([apisix/cli/file.lua#L104-L127](https://github.com/apache/apisix/blob/2b6d519a01e446b5b1d98168cedf9a7a4daa40b6/apisix/cli/file.lua#L104-L127)).
`check_token` then compares the request header, which is a string, with the
configured key, which is now a number
([apisix/admin/init.lua#L103-L113](https://github.com/apache/apisix/blob/2b6d519a01e446b5b1d98168cedf9a7a4daa40b6/apisix/admin/init.lua#L103-L113)),
so they never match. The CLI schema declares `key` as a string
([apisix/cli/schema.lua#L385-L392](https://github.com/apache/apisix/blob/2b6d519a01e446b5b1d98168cedf9a7a4daa40b6/apisix/cli/schema.lua#L385-L392)),
but `apisix init` accepted the value without an error in my test.
This affects any deployment that injects the key from a secret store as an
environment variable. One example is the Helm chart's
`apisix.admin.credentials.secretName` option, which renders `key:
${{APISIX_ADMIN_KEY}}`.
### Expected Behavior
A substituted value for a string field stays a string, so a numeric key
works like any other key. If that is not possible, APISIX should refuse to
start with a clear error instead of rejecting every request.
### Error Logs
The Admin API returns `401` even with the correct key.
### Steps to Reproduce
```sh
cat > config.yaml <<'EOF'
deployment:
role: traditional
role_traditional:
config_provider: yaml
admin:
allow_admin:
- 0.0.0.0/0
admin_key:
- name: admin
key: ${{APISIX_ADMIN_KEY}}
role: admin
EOF
printf 'routes: []\n#END\n' > apisix.yaml
docker run -d --name numeric-key -p 9180:9180 -e APISIX_ADMIN_KEY=123456 \
-v "$PWD/config.yaml:/usr/local/apisix/conf/config.yaml:ro" \
-v "$PWD/apisix.yaml:/usr/local/apisix/conf/apisix.yaml:ro" \
apache/apisix:3.19.0-debian
sleep 5
curl -s -o /dev/null -w '%{http_code}\n' -H 'X-API-KEY: 123456' \
http://127.0.0.1:9180/apisix/admin/configs
# prints 401
```
With `APISIX_ADMIN_KEY=AbCdEf123` or `APISIX_ADMIN_KEY='Ab#c: d'`, the same
request returns 200.
### Environment
- APISIX version: 3.19.0 (`apache/apisix:3.19.0-debian`). The same code is
on master at `2b6d519`.
- Operating system: Linux container on Docker Desktop
- OpenResty / Nginx version: the one bundled in the image
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
