nic-6443 commented on code in PR #13649: URL: https://github.com/apache/apisix/pull/13649#discussion_r3717586009
########## apisix/plugins/openid-connect.lua: ########## @@ -58,6 +58,25 @@ local function build_session_opts(session_conf) end +local function flatten_openidc_options(conf) Review Comment: The flat lua-resty-openidc option names need to be rejected here or in . The root schema accepts unknown properties, so , , and currently pass validation. I reproduced this through the Admin API: was stored verbatim in etcd, and because is absent this function leaves all three flat fields intact, so 1.9.0 activates DPoP with the plaintext key. This also bypasses the nested public-JWK checks; the equivalent flat PAR fields bypass validation. Please make the flat PAR/DPoP names invalid input, or otherwise guarantee they cannot bypass validation and encryption, and add an Admin API regression. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
