shreemaan-abhishek opened a new pull request, #14108: URL: https://github.com/apache/apisix/pull/14108
### Description With `match_uri_encoded_slash: true`, the router matches on a URI that keeps `%2F` as part of a path segment, while `skip_mtls_uri_regex` is checked against the decoded `$uri`. The two can disagree: `/public%2Fstatus` matches an exemption `^/public/status$` as `/public/status`, but the router dispatches it to a parameter route such as `/:resource`, which then runs without the client certificate check. Changes: - Extract the `%2F`-kept match URI construction into `encoded_slash_match_uri()`, shared by the router and the mTLS check. - `skip_mtls()` skips the client certificate only when both the decoded URI and the `%2F`-kept match URI match `skip_mtls_uri_regex`. - Document the behavior in the `client.skip_mtls_uri_regex` field description. Behavior is unchanged when `match_uri_encoded_slash` is off or the path has no encoded slash. Exemptions that also cover the encoded form (e.g. `^/open/.*` for `/open/a%2Fb`) keep skipping the certificate. #### Which issue(s) this PR fixes: <!-- *Automatically closes linked issue when PR is merged. Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`. --> Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
