-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(openid-connect): use_jwks breaking authentication header #10670
fix(openid-connect): use_jwks breaking authentication header #10670
Conversation
cca43f2
to
183193f
Compare
183193f
to
4e96732
Compare
Could you add test cases like https://github.com/apache/apisix/blob/master/t/plugin/openid-connect.t#L900 |
I'm still a bit confused on how the APISIX tests work, but I've added a test that should check for the bug in #10670. |
222c842
to
0c3801a
Compare
I can't replicate the linting failure by running |
I've tried that, |
t/plugin/openid-connect.t
Outdated
@@ -1241,7 +1345,7 @@ passed | |||
|
|||
|
|||
|
|||
=== TEST 33: Access route to validate "x-userinfo" in request header | |||
=== TEST 35: Access route to validate "x-userinfo" in request header |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I suggest put your newly added test cases to the end of the file, so that you won't need to modify the index of the rest test cases.
The index of test cases below this one are not correct
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oh of course, I'm not sure how I missed that. I've updated the test file.
0c3801a
to
90f9828
Compare
If you use jwks instead of explicitly setting the public key, requests with a proper `Authorization: Bearer` header would still get the `302 Found` response. Fix by adding `conf.use_jwks` to the check.
90f9828
to
07e0cb3
Compare
I believe the linting should pass now. |
Description
When using the openid-connect plugin with
bearer_only
as false, the plugin will normally authenticate both requests with the session cookie and requests with an explicitAuthorization: Bearer
header. This is very useful to allow both browser based and programmatic access to some resource.However, if you set
use_jwks
instead of explicitly setting the public key, requests with a properAuthorization: Bearer
header still get the302 Found
response.Fix by adding
conf.use_jwks
to the check.Fixes #10669