kayx23 commented on code in PR #14119: URL: https://github.com/apache/apisix/pull/14119#discussion_r4510328509
########## docs/en/latest/plugins/request-validation.md: ########## @@ -55,6 +55,12 @@ At least one of `header_schema` or `body_schema` should be filled in. ::: +:::note + +`header_schema` is checked against the first 100 request headers, the default limit of [`ngx.req.get_headers()`](https://github.com/openresty/lua-nginx-module#ngxreqget_headers). Headers after the 100th are not validated and are still forwarded to the Upstream. To keep a header from reaching the Upstream, remove it with the `headers.remove` attribute of the [`proxy-rewrite`](./proxy-rewrite.md) Plugin. Review Comment: This wording is factually accurate but understates the consequence. `core.request.headers()` discards the `"truncated"` return from `ngx.req.get_headers()`, so a schema that forbids or constrains a header can be bypassed by placing that header outside the inspected set while NGINX still forwards it. Please treat this as a security boundary rather than an informational note: use a caution, state that `header_schema` cannot enforce policy over uninspected headers, and link the public issue for the runtime fix. The same concern applies to the OPA note. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
