nic-6443 commented on PR #13524: URL: https://github.com/apache/apisix/pull/13524#issuecomment-4876968294
@kevinlzw Thanks! I verified your fix against APISIX: I ran this PR's test suite (a strict mock introspection endpoint that rejects requests carrying credentials in both the Authorization header and the body) on current master with lua-resty-openidc bumped to 1.9.0 and **without** the plugin-side workaround from this PR — all tests pass. With 1.8.0 the same tests fail, so the upstream fix alone resolves the problem. One detail worth noting: your fix keeps the legacy body-credentials behavior when `introspection_endpoint_auth_method` is unset, but that doesn't affect APISIX — the plugin schema declares `default = "client_secret_basic"`, so the option is always materialized into the opts passed to `openidc.introspect()` and the new code path is taken. Since v1.9.0 is already released and published to LuaRocks, the right fix for APISIX is now simply bumping the dependency in the rockspec instead of patching around it, so I'm closing this PR. Would you like to submit the version-bump PR? Since you authored the upstream fix, it seems fitting — and feel free to pick up `t/plugin/openid-connect11.t` from this PR as regression coverage if useful. Otherwise happy to do it myself. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
