shreemaan-abhishek opened a new pull request, #13905: URL: https://github.com/apache/apisix/pull/13905
### Description When `multi-auth` combines Wolf with another authenticator, Wolf's reserved identity headers can remain on the request when the other method succeeds. Wolf currently clears those headers only after token and consumer lookup, so an early decline or an earlier successful authenticator skips that cleanup. This change adds an optional cleanup hook for authenticator-owned output headers. `multi-auth` invokes it for every configured method before selecting a winner and again after a method declines. Wolf implements the hook for the default identity headers and every configured custom-prefix variant. Outputs produced by the successful authenticator remain unchanged. Regression coverage exercises Wolf before and after the successful fallback, default and custom prefixes, and a declining authenticator that wrote an output header. #### Behavior change On routes combining Wolf with `multi-auth`, client values using Wolf's reserved identity-header names are now removed even when another method succeeds. Deployments should use different header names for unrelated client metadata. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [ ] I have verified that this change is backward compatible (behavior change described above) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
