luarx opened a new issue, #14193: URL: https://github.com/apache/apisix/issues/14193
### Description ### Problem `ip-restriction` cannot block a client before a rewrite-phase auth plugin acts on the request. `ip-restriction` runs in the `access` phase, while auth plugins such as `openid-connect`, `key-auth` and `jwt-auth` run in `rewrite`. Phases run before priorities, so on a route that has both, the IP allowlist is only checked after authentication, even though `ip-restriction` has a higher priority (3000) than `openid-connect` (2599). With `openid-connect` this has a visible effect: a client outside the allowlist is still redirected to the identity provider's login page. The allowlist can't hide or protect the login flow, and the 403 only comes after a successful login. ### Steps to reproduce 1. Create a route with `ip-restriction` (`whitelist: ["10.0.0.0/16"]`) and `openid-connect`. 2. Request it from an IP outside the whitelist. 3. Expected: 403. Actual: 302 to the identity provider. ### Possible solutions - An optional `phase` attribute on `ip-restriction` (`access` by default, or `rewrite`). - Running `ip-restriction` in `rewrite` by default. Simpler, but it changes behaviour for existing users, and per-consumer rules need the consumer to be known first. - Documenting the limitation and the recommended workaround. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
