janiussyafiq opened a new pull request, #13884: URL: https://github.com/apache/apisix/pull/13884
### Description The `basic-auth` consumer schema accepted `password: ""`, and such a consumer could authenticate with `user: ` on the wire (and with `user:` once #13836 splits credentials on the first colon). - `consumer_schema.password` now requires `minLength = 1`, so the Admin API rejects an empty password on consumers and credentials. - The plugin fails closed with the usual generic 401 when the resolved password is empty, which also covers data written before this change and `$secret://` / `$env://` references that resolve to `""`. - Docs: the `password` attribute is documented as a non-empty string. #### Which issue(s) this PR fixes: Fixes #13881 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
