This is an automated email from the ASF dual-hosted git repository.
shreemaan-abhishek pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 0f35b1548 fix(wolf-rbac): clear upstream identity headers when auth
response omits userInfo (#13696)
0f35b1548 is described below
commit 0f35b154824ed51d0d4bdadc78d1d5fa9ed1ec62
Author: Shreemaan Abhishek <[email protected]>
AuthorDate: Mon Jul 20 18:41:43 2026 +0800
fix(wolf-rbac): clear upstream identity headers when auth response omits
userInfo (#13696)
---
apisix/plugins/wolf-rbac.lua | 6 +++-
t/lib/server.lua | 3 ++
t/plugin/wolf-rbac.t | 71 ++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 79 insertions(+), 1 deletion(-)
diff --git a/apisix/plugins/wolf-rbac.lua b/apisix/plugins/wolf-rbac.lua
index e27607186..f52faf0cd 100644
--- a/apisix/plugins/wolf-rbac.lua
+++ b/apisix/plugins/wolf-rbac.lua
@@ -287,13 +287,17 @@ function _M.rewrite(conf, ctx)
local username = nil
local nickname = nil
+ local prefix = cur_consumer.auth_conf.header_prefix or ''
+ -- drop client-supplied identity headers before trusting the auth response
+ core.request.set_header(ctx, prefix .. "UserId", nil)
+ core.request.set_header(ctx, prefix .. "Username", nil)
+ core.request.set_header(ctx, prefix .. "Nickname", nil)
if type(res.userInfo) == 'table' then
local userInfo = res.userInfo
ctx.userInfo = userInfo
local userId = userInfo.id
username = userInfo.username
nickname = userInfo.nickname or userInfo.username
- local prefix = cur_consumer.auth_conf.header_prefix or ''
core.response.set_header(prefix .. "UserId", userId)
core.response.set_header(prefix .. "Username", username)
core.response.set_header(prefix .. "Nickname",
ngx.escape_uri(nickname))
diff --git a/t/lib/server.lua b/t/lib/server.lua
index 71b34912a..35322155d 100644
--- a/t/lib/server.lua
+++ b/t/lib/server.lua
@@ -323,6 +323,9 @@ function _M.wolf_rbac_access_check()
ngx.say(json_encode({ok=true,
data={ userInfo={nickname="administrator",
username="admin", id="100"} }}))
+ elseif resName == '/hello/no_userinfo' then
+ -- authorized (200) but the backend returns no userInfo
+ ngx.say(json_encode({ok=true, data={}}))
elseif resName == '/hello/500' then
ngx.status = 500
ngx.say(json_encode({ok=false, reason="ERR_SERVER_ERROR"}))
diff --git a/t/plugin/wolf-rbac.t b/t/plugin/wolf-rbac.t
index b7bf5f899..cb8638b99 100644
--- a/t/plugin/wolf-rbac.t
+++ b/t/plugin/wolf-rbac.t
@@ -890,3 +890,74 @@ X-Real-IP: 192.0.2.10
wolf_rbac_access_check clientIP: 127.0.0.1
--- no_error_log
wolf_rbac_access_check clientIP: 192.0.2.10
+
+
+
+=== TEST 43: consumer and route that echo upstream-bound request headers
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/consumers',
+ ngx.HTTP_PUT,
+ [[{
+ "username": "wolf_rbac_no_echo",
+ "plugins": {
+ "wolf-rbac": {
+ "appid": "wolf-rbac-app-noecho",
+ "server": "http://127.0.0.1:1982";
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.status = code
+ ngx.say(body)
+ return
+ end
+
+ code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "wolf-rbac": {},
+ "serverless-post-function": {
+ "phase": "access",
+ "functions": [
+ "return function(conf, ctx) local core =
require(\"apisix.core\"); core.response.exit(200, core.request.headers(ctx));
end"
+ ]
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1982": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello/no_userinfo"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 44: client-supplied identity headers dropped when auth response omits
userInfo
+--- request
+GET /hello/no_userinfo
+--- more_headers
+Authorization: V1#wolf-rbac-app-noecho#wolf-rbac-token
+X-UserId: spoofid007
+X-Username: spoofadmin
+--- error_code: 200
+--- response_body_like eval
+qr/(?s)^(?!.*spoofid007)(?!.*spoofadmin).*authorization/
+--- no_error_log
+[error]
