luarx opened a new pull request, #14194: URL: https://github.com/apache/apisix/pull/14194
### Description `ip-restriction` runs in the `access` phase, so on a route that also has a rewrite-phase auth plugin (`openid-connect`, `key-auth`, `jwt-auth`, ...) the IP allowlist is only checked after authentication. With `openid-connect`, a client outside the allowlist is still redirected to the identity provider's login page. This PR adds an optional `phase` attribute to `ip-restriction`: - unset or `access`: current behaviour, no change for existing configurations. - `rewrite`: the check runs in the rewrite phase. With priority 3000 it runs before every built-in auth plugin. Implementation notes: - No schema default, so existing stored configurations and stream routes don't change (the stream plugin ignores `phase`). - A `rewrite` conf is recorded per request when it runs. `access` checks every conf that was not already checked, so a conf that never got a rewrite pass is still enforced. One example is a consumer conf that replaces the route's conf after authentication. A conf can't be skipped by mistake (fail closed), and is never checked twice. - With `rewrite` on a route, a consumer-level `ip-restriction` still applies after authentication, but it can no longer loosen the route's check. Both apply. - On a global rule, `rewrite` runs before route and service plugins, so a route-level `real-ip` would not be applied yet. This is documented. - Like `serverless-pre-function`, the plugin now has both `rewrite` and `access` handlers, so `_meta.pre_function` and debug mode see both. #### Which issue(s) this PR fixes: Fixes #14193 ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
