This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new e40857a7ba fix(jwe-decrypt): skip decrypt when token is missing and
strict is false (#13822)
e40857a7ba is described below
commit e40857a7bad6c2219504ed48d5911a8d401134fa
Author: Arjen10 <[email protected]>
AuthorDate: Fri Aug 14 17:44:42 2026 +0800
fix(jwe-decrypt): skip decrypt when token is missing and strict is false
(#13822)
---
apisix/plugins/jwe-decrypt.lua | 11 +++++++---
t/plugin/jwe-decrypt.t | 47 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 55 insertions(+), 3 deletions(-)
diff --git a/apisix/plugins/jwe-decrypt.lua b/apisix/plugins/jwe-decrypt.lua
index fbc9d3fff9..9c74aaf5df 100644
--- a/apisix/plugins/jwe-decrypt.lua
+++ b/apisix/plugins/jwe-decrypt.lua
@@ -175,9 +175,14 @@ end
function _M.rewrite(conf, ctx)
-- fetch token and hide credentials if necessary
local jwe_token, err = fetch_jwe_token(conf, ctx)
- if not jwe_token and conf.strict then
- core.log.info("failed to fetch JWE token: ", err)
- return 403, { message = "missing JWE token in request" }
+ if not jwe_token then
+ -- If true, throw a 403 error if JWE token is missing from the request.
+ -- If false, do not throw an error when JWE token is not found.
+ if conf.strict then
+ core.log.info("failed to fetch JWE token: ", err)
+ return 403, { message = "missing JWE token in request" }
+ end
+ return
end
local jwe_obj = load_jwe_token(jwe_token)
diff --git a/t/plugin/jwe-decrypt.t b/t/plugin/jwe-decrypt.t
index d862015055..be346ea1d2 100644
--- a/t/plugin/jwe-decrypt.t
+++ b/t/plugin/jwe-decrypt.t
@@ -577,3 +577,50 @@ done
}
--- response_body
status: 400
+
+
+
+=== TEST 24: enable jwe-decrypt with strict=false
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/11',
+ ngx.HTTP_PUT,
+ [[{
+ "plugins": {
+ "jwe-decrypt": {
+ "header": "Authorization",
+ "forward_header": "Authorization",
+ "strict": false
+ },
+ "proxy-rewrite": {
+ "uri": "/hello"
+ }
+ },
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ },
+ "uri": "/hello-nonstrict"
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 25: missing token with strict=false is allowed
+--- request
+GET /hello-nonstrict
+--- response_body
+hello world
