AlinsRan opened a new pull request, #13699: URL: https://github.com/apache/apisix/pull/13699
### Description `ai-transport`'s `construct_forward_headers` read the downstream request's headers straight from `ctx` (`core.request.headers(ctx)`) and **always** forwarded them to the LLM endpoint. That is correct for the transparent proxy path (`ai-proxy` / `ai-proxy-multi`), but wrong for plugins that make a **self-contained internal LLM call**: `ai-request-rewrite` calls an LLM to rewrite the request body. Because the shared transport always forwarded client headers, the client's `Authorization` / `Cookie` were sent to that third-party LLM endpoint — a header leak. **Fix — make the transport `ctx`-free:** - `construct_forward_headers(ext_opts_headers, client_headers)` now takes an explicit `client_headers` table (nil for internal requests) instead of reading `core.request.headers(ctx)`. The transport no longer has any downstream-request coupling. - `build_request` forwards `opts.client_headers`; only the proxy path (`ai-proxy/base.lua`) sets it from `core.request.headers(ctx)` (it legitimately holds `ctx` in the request phase). - Internal callers (`ai-request-rewrite`, and any future embeddings / RAG / moderation call) pass none, so their own credentials — not the client's — reach the LLM. No config or behavior change for the proxy path; the leak is closed for internal calls. ### Tests Added `t/plugin/ai-transport-header-forwarding.t` with self-contained mocks: - `ai-request-rewrite`'s internal rewrite call receives **no** client `Cookie` (leak fixed). - `ai-proxy-multi`'s transparent proxy path **still** forwards the client `Cookie`. Verified the test catches the leak: it fails on the pre-fix code (the mock LLM receives `session=super-secret`) and passes after. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change (n/a — no user-facing config change) - [x] I have verified that this change is backward compatible -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
