janiussyafiq opened a new issue, #13881:
URL: https://github.com/apache/apisix/issues/13881
### Current Behavior
The `basic-auth` consumer schema declares `password = { type = "string" }`
with no `minLength`, so the Admin API accepts a consumer whose password is
`""`. Such a consumer then authenticates, so it looks protected while it
effectively has no secret:
- on `master`, `Authorization: Basic base64("alice: ")` returns 200: the
whitespace is stripped by the `\s+` gsub and the plugin compares `"" == ""`.
- `base64("alice:")` currently returns 401 only by accident (`ngx.re.split`
drops the trailing empty field, so the credential is treated as malformed).
Once #13836 lands (split on the first colon, which is the correct RFC 7617
parsing), `alice:` returns 200 as well.
RFC 7617 lets `user:` appear on the wire, but the OpaqueString password
profile it points to (RFC 8265, section 4.1) says a password MUST NOT be
zero-length.
### Expected Behavior
- The Admin API rejects `password: ""` on consumer / credential create and
update (`minLength = 1` on `consumer_schema.password`).
- The plugin fails closed with the usual generic 401 when the resolved
password is empty, which also covers existing data and `$secret://` / `$ENV://`
references that resolve to `""`.
- Regression tests: Admin API rejection of `password: ""`, `user:` returns
401, an empty secret reference returns 401, and a password containing `:` keeps
authenticating (from #13836).
### Error Logs
None, the request succeeds.
### Steps to Reproduce
```shell
# 1. consumer with an empty password: accepted
curl -s http://127.0.0.1:9180/apisix/admin/consumers -H "X-API-KEY: $KEY" -X
PUT \
-d
'{"username":"alice","plugins":{"basic-auth":{"username":"alice","password":""}}}'
# 2. route protected by basic-auth
curl -s http://127.0.0.1:9180/apisix/admin/routes/1 -H "X-API-KEY: $KEY" -X
PUT \
-d
'{"uri":"/hello","plugins":{"basic-auth":{}},"upstream":{"type":"roundrobin","nodes":{"127.0.0.1:1980":1}}}'
# 3. whitespace-only password: 200 on master, expected 401
curl -si http://127.0.0.1:9080/hello -H "Authorization: Basic $(printf
'alice: ' | base64)"
# 4. empty password: 401 on master by accident, 200 with #13836 applied,
expected 401
curl -si http://127.0.0.1:9080/hello -H "Authorization: Basic $(printf
'alice:' | base64)"
```
### Environment
- APISIX version (run `apisix version`): master (3.18.0), step 4 also
verified on the #13836 branch
- Operating system (run `uname -a`): Linux 7.0.14 aarch64
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
openresty/1.27.1.2
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`): 3.5.11
- APISIX Dashboard version, if relevant: n/a
- Plugin runner version, for issues related to plugin runners: n/a
- LuaRocks version, for installation issues (run `luarocks --version`): n/a
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
