This is an automated email from the ASF dual-hosted git repository.
shreemaan-abhishek pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 6a0ab86d3b fix(key-auth): propagate real auth error to multi-auth
orchestrator (#13693)
6a0ab86d3b is described below
commit 6a0ab86d3be40f5e87d2df8c019b2d5ee226feff
Author: Shreemaan Abhishek <[email protected]>
AuthorDate: Wed Jul 15 16:49:48 2026 +0800
fix(key-auth): propagate real auth error to multi-auth orchestrator (#13693)
---
apisix/plugins/key-auth.lua | 14 ++++++++++++--
docs/en/latest/plugins/multi-auth.md | 2 ++
t/plugin/multi-auth2.t | 4 +++-
3 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/apisix/plugins/key-auth.lua b/apisix/plugins/key-auth.lua
index 14944e98b5..69e232c7d1 100644
--- a/apisix/plugins/key-auth.lua
+++ b/apisix/plugins/key-auth.lua
@@ -18,6 +18,7 @@ local core = require("apisix.core")
local consumer_mod = require("apisix.consumer")
local plugin_name = "key-auth"
local schema_def = require("apisix.schema_def")
+local auth_utils = require("apisix.utils.auth")
local schema = {
type = "object",
@@ -83,7 +84,12 @@ local function find_consumer(ctx, conf)
local consumer, consumer_conf, err =
consumer_mod.find_consumer(plugin_name, "key", key)
if not consumer then
- core.log.warn("failed to find consumer: ", err or "invalid api key")
+ err = "failed to find consumer: " .. (err or "invalid api key")
+ -- surface the real reason to the multi-auth orchestrator
+ if auth_utils.is_running_under_multi_auth(ctx) then
+ return nil, nil, err
+ end
+ core.log.warn(err)
return nil, nil, "Invalid API key in request"
end
@@ -125,9 +131,13 @@ function _M.rewrite(conf, ctx)
end
consumer, consumer_conf, err =
consumer_mod.get_anonymous_consumer(conf.anonymous_consumer)
if not consumer then
+ core.response.set_header("WWW-Authenticate", "apikey realm=\"" ..
conf.realm .. "\"")
+ -- surface the real reason to the multi-auth orchestrator
+ if auth_utils.is_running_under_multi_auth(ctx) then
+ return 401, err
+ end
err = "key-auth failed to authenticate the request, code: 401.
error: " .. err
core.log.error(err)
- core.response.set_header("WWW-Authenticate", "apikey realm=\"" ..
conf.realm .. "\"")
return 401, { message = "Invalid user authorization"}
end
end
diff --git a/docs/en/latest/plugins/multi-auth.md
b/docs/en/latest/plugins/multi-auth.md
index a5bdf76335..282b4b6360 100644
--- a/docs/en/latest/plugins/multi-auth.md
+++ b/docs/en/latest/plugins/multi-auth.md
@@ -39,6 +39,8 @@ import TabItem from '@theme/TabItem';
The `multi-auth` Plugin allows Consumers using different authentication
methods to share the same Route or Service. It supports the configuration of
multiple authentication Plugins, so that a request would be allowed through if
it authenticates successfully against any configured authentication method.
+When every configured method fails, the request is rejected with a `401` and
each method's underlying failure reason is written to the error log (for
example, `key-auth failed to authenticate the request, code: 401. error: failed
to find consumer: invalid api key`), which helps diagnose why a particular
authentication method rejected the request.
+
## Attributes
| Name | Type | Required | Default | Valid values | Description |
diff --git a/t/plugin/multi-auth2.t b/t/plugin/multi-auth2.t
index bc15a369d2..adfb210ca3 100644
--- a/t/plugin/multi-auth2.t
+++ b/t/plugin/multi-auth2.t
@@ -116,9 +116,11 @@ apikey: 123
{"message":"Authorization Failed"}
--- error_log
basic-auth failed to authenticate the request, code: 401. error: Missing
authorization in request
-key-auth failed to authenticate the request, code: 401. error: Invalid API key
in request
+key-auth failed to authenticate the request, code: 401. error: failed to find
consumer: invalid api key
jwt-auth failed to authenticate the request, code: 401. error: Missing JWT
token in request
hmac-auth failed to authenticate the request, code: 401. error: client request
can't be validated: missing Authorization header
+--- no_error_log
+error: Invalid API key in request
