You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by sp...@apache.org on 2022/03/28 13:26:20 UTC
[apisix] branch master updated: feat: add auth plugin for casdoor (#6382)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new c8fe8ab feat: add auth plugin for casdoor (#6382)
c8fe8ab is described below
commit c8fe8ab73ad0f2ef87a4637f97a47313437c08c9
Author: Товарищ программист <46...@users.noreply.github.com>
AuthorDate: Mon Mar 28 21:26:12 2022 +0800
feat: add auth plugin for casdoor (#6382)
---
apisix/plugins/authz-casdoor.lua | 173 +++++++++++++
conf/config-default.yaml | 1 +
docs/en/latest/config.json | 1 +
docs/en/latest/plugins/authz-casdoor.md | 84 ++++++
t/admin/plugins.t | 1 +
t/plugin/authz-casdoor.t | 444 ++++++++++++++++++++++++++++++++
6 files changed, 704 insertions(+)
diff --git a/apisix/plugins/authz-casdoor.lua b/apisix/plugins/authz-casdoor.lua
new file mode 100644
index 0000000..9fd8d8d
--- /dev/null
+++ b/apisix/plugins/authz-casdoor.lua
@@ -0,0 +1,173 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local core = require("apisix.core")
+local http = require("resty.http")
+local session = require("resty.session")
+local ngx = ngx
+local rand = math.random
+local tostring = tostring
+
+
+local plugin_name = "authz-casdoor"
+local schema = {
+ type = "object",
+ properties = {
+ -- Note: endpoint_addr and callback_url should not end with '/'
+ endpoint_addr = {type = "string", pattern = "^[^%?]+[^/]$"},
+ client_id = {type = "string"},
+ client_secret = {type = "string"},
+ callback_url = {type = "string", pattern = "^[^%?]+[^/]$"}
+ },
+ required = {
+ "callback_url", "endpoint_addr", "client_id", "client_secret"
+ }
+}
+
+local _M = {
+ version = 0.1,
+ priority = 2559,
+ name = plugin_name,
+ schema = schema
+}
+
+local function fetch_access_token(code, conf)
+ local client = http.new()
+ local url = conf.endpoint_addr .. "/api/login/oauth/access_token"
+ local res, err = client:request_uri(url, {
+ method = "POST",
+ body = ngx.encode_args({
+ code = code,
+ grant_type = "authorization_code",
+ client_id = conf.client_id,
+ client_secret = conf.client_secret
+ }),
+ headers = {
+ ["Content-Type"] = "application/x-www-form-urlencoded"
+ }
+ })
+
+ if not res then
+ return nil, nil, err
+ end
+ local data, err = core.json.decode(res.body)
+
+ if err or not data then
+ err = "failed to parse casdoor response data: " .. err .. ", body: " .. res.body
+ return nil, nil, err
+ end
+
+ if not data.access_token then
+ return nil, nil,
+ "failed when accessing token: no access_token contained"
+ end
+ -- In the reply of casdoor, setting expires_in to 0 indicates that the access_token is invalid.
+ if not data.expires_in or data.expires_in == 0 then
+ return nil, nil, "failed when accessing token: invalid access_token"
+ end
+
+ return data.access_token, data.expires_in, nil
+end
+
+
+function _M.check_schema(conf)
+ return core.schema.check(schema, conf)
+end
+
+
+function _M.access(conf, ctx)
+ local current_uri = ctx.var.uri
+ local session_obj_read, session_present = session.open()
+ -- step 1: check whether hits the callback
+ local m, err = ngx.re.match(conf.callback_url, ".+//[^/]+(/.*)", "jo")
+ if err or not m then
+ core.log.error(err)
+ return 503
+ end
+ local real_callback_url = m[1]
+ if current_uri == real_callback_url then
+ if not session_present then
+ err = "no session found"
+ core.log.error(err)
+ return 503
+ end
+ local state_in_session = session_obj_read.data.state
+ if not state_in_session then
+ err = "no state found in session"
+ core.log.error(err)
+ return 503
+ end
+ local args = core.request.get_uri_args(ctx)
+ if not args or not args.code or not args.state then
+ err = "failed when accessing token. Invalid code or state"
+ core.log.error(err)
+ return 400, err
+ end
+ if args.state ~= tostring(state_in_session) then
+ err = "invalid state"
+ core.log.error(err)
+ return 400, err
+ end
+ if not args.code then
+ err = "invalid code"
+ core.log.error(err)
+ return 400, err
+ end
+ local access_token, lifetime, err =
+ fetch_access_token(args.code, conf)
+ if not access_token then
+ core.log.error(err)
+ return 503
+ end
+ local original_url = session_obj_read.data.original_uri
+ if not original_url then
+ err = "no original_url found in session"
+ core.log.error(err)
+ return 503
+ end
+ local session_obj_write = session.new {
+ cookie = {lifetime = lifetime}
+ }
+ session_obj_write:start()
+ session_obj_write.data.access_token = access_token
+ session_obj_write:save()
+ core.response.set_header("Location", original_url)
+ return 302
+ end
+
+ -- step 2: check whether session exists
+ if not (session_present and session_obj_read.data.access_token) then
+ -- session not exists, redirect to login page
+ local state = rand(0x7fffffff)
+ local session_obj_write = session.start()
+ session_obj_write.data.original_uri = current_uri
+ session_obj_write.data.state = state
+ session_obj_write:save()
+
+ local redirect_url = conf.endpoint_addr .. "/login/oauth/authorize?" .. ngx.encode_args({
+ response_type = "code",
+ scope = "read",
+ state = state,
+ client_id = conf.client_id,
+ redirect_uri = conf.callback_url
+ })
+ core.response.set_header("Location", redirect_url)
+ return 302
+ end
+
+end
+
+return _M
diff --git a/conf/config-default.yaml b/conf/config-default.yaml
index f96b839..74a187e 100644
--- a/conf/config-default.yaml
+++ b/conf/config-default.yaml
@@ -344,6 +344,7 @@ plugins: # plugin list (sorted by priority)
- request-validation # priority: 2800
- openid-connect # priority: 2599
- authz-casbin # priority: 2560
+ - authz-casdoor # priority: 2559
- wolf-rbac # priority: 2555
- ldap-auth # priority: 2540
- hmac-auth # priority: 2530
diff --git a/docs/en/latest/config.json b/docs/en/latest/config.json
index f4d1e5a..e29a3d2 100644
--- a/docs/en/latest/config.json
+++ b/docs/en/latest/config.json
@@ -71,6 +71,7 @@
"plugins/jwt-auth",
"plugins/basic-auth",
"plugins/authz-keycloak",
+ "plugins/authz-casdoor",
"plugins/wolf-rbac",
"plugins/openid-connect",
"plugins/hmac-auth",
diff --git a/docs/en/latest/plugins/authz-casdoor.md b/docs/en/latest/plugins/authz-casdoor.md
new file mode 100644
index 0000000..bf6583d
--- /dev/null
+++ b/docs/en/latest/plugins/authz-casdoor.md
@@ -0,0 +1,84 @@
+---
+title: authz-casdoor
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Description
+
+`authz-casdoor` is an authorization plugin based on [Casdoor](https://casdoor.org/). Casdoor is a centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management.
+
+## Attributes
+
+| Name | Type | Requirement | Default | Valid | Description |
+| ----------- | ------ | ----------- | ------- | ----- | ------------------------------------------------------------ |
+| endpoint_addr | string | required | | | The url of casdoor. |
+| client_id | string | required | | | The client id in casdoor. |
+| client_secret | string | required | | | The client secret in casdoor. |
+| callback_url | string | required | | | The callback url which is used to receive state and code. |
+
+*Note: endpoint_addr and callback_url should not end with '/'*
+
+## How To Enable
+
+You can enable the plugin on any route by giving out all attributes mentioned above.
+
+### Example
+
+```shell
+curl "http://127.0.0.1:9080/apisix/admin/routes/1" -H "X-API-KEY: edd1c9f034335f136f87ad84b625c8f1" -X PUT -d '
+{
+ "methods": ["GET"],
+ "uri": "/anything/*",
+ "plugins": {
+ "authz-casdoor": {
+ "endpoint_addr":"http://localhost:8000",
+ "callback_url":"http://localhost:9080/anything/callback",
+ "client_id":"7ceb9b7fda4a9061ec1c",
+ "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04"
+ }
+ },
+ "upstream": {
+ "type": "roundrobin",
+ "nodes": {
+ "httpbin.org:80": 1
+ }
+ }
+}'
+
+```
+
+In this example, using apisix's admin API we created a route "/anything/*" pointed to "httpbin.org:80", and with "authz-casdoor" enabled. This route is now under authentication protection of Casdoor.
+
+#### Explanations about parameters of this plugin
+
+In the configuration of "authz-casdoor" plugin we can see four parameters.
+
+The first one is "callback_url". This is exactly the callback url in OAuth2. It should be emphasized that this callback url **must belong to the "uri" you specified for the route**, for example, in this example, http://localhost:9080/anything/callback obviously belong to "/anything/*". Only by this way can the visit toward callback_url can be intercepted and utilized by the plugin(so that the plugin can get the code and state in Oauth2). The logic of callback_url is implemented completel [...]
+
+The second parameter "endpoint_addr" is obviously the url of Casdoor. The third and fourth parameters are "client_id" and "client_secret", which you can acquire from Casdoor when you register an app.
+
+#### How it works?
+
+Suppose a new user who has never visited this route before is going to visit it (http://localhost:9080/anything/d?param1=foo¶m2=bar), considering that "authz-casdoor" is enabled, this visit would be processed by "authz-casdoor" plugin first. After checking the session and confirming that this user hasn't been authenticated, the visit will be intercepted. With the original url user wants to visit kept, he will be redirected to the login page of Casdoor.
+
+After successfully logging in with username and password(or whatever method he uses), Casdoor will redirect this user to the "callback_url" with GET parameter "code" and "state" specified. Because the "callback_url" is known by the plugin, when the visit toward the "callback_url" is intercepted this time, the logic of "Authorization code Grant Flow" in Oauth2 will be triggered, which means this plugin will request the access token to confirm whether this user is really logged in. After t [...]
+
+Next time this user want to visit url behind this route (for example, http://localhost:9080/anything/d), after discovering that this user has been authenticated previously, this plugin won't redirect this user anymore so that this user can visit whatever he wants under this route without being interfered.
diff --git a/t/admin/plugins.t b/t/admin/plugins.t
index 2cd06c8..2557da7 100644
--- a/t/admin/plugins.t
+++ b/t/admin/plugins.t
@@ -79,6 +79,7 @@ uri-blocker
request-validation
openid-connect
authz-casbin
+authz-casdoor
wolf-rbac
ldap-auth
hmac-auth
diff --git a/t/plugin/authz-casdoor.t b/t/plugin/authz-casdoor.t
new file mode 100644
index 0000000..a192064
--- /dev/null
+++ b/t/plugin/authz-casdoor.t
@@ -0,0 +1,444 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+no_long_string();
+no_root_location();
+add_block_preprocessor(sub {
+ my ($block) = @_;
+
+ if ((!defined $block->error_log) && (!defined $block->no_error_log)) {
+ $block->set_value("no_error_log", "[error]");
+ }
+
+ if (!defined $block->request) {
+ $block->set_value("request", "GET /t");
+ }
+
+ my $http_config = $block->http_config // <<_EOC_;
+ server {
+ listen 10420;
+ location /api/login/oauth/access_token {
+ content_by_lua_block {
+ local json_encode = require("toolkit.json").encode
+ ngx.req.read_body()
+ local arg = ngx.req.get_post_args()["code"]
+
+ local core = require("apisix.core")
+ local log = core.log
+
+ if arg == "wrong" then
+ ngx.status = 200
+ ngx.say(json_encode({ access_token = "bbbbbbbbbb", expires_in = 0 }))
+ return
+ end
+
+ ngx.status = 200
+ ngx.say(json_encode({ access_token = "aaaaaaaaaaaaaaaa", expires_in = 1000000 }))
+ }
+ }
+ }
+_EOC_
+
+ $block->set_value("http_config", $http_config);
+});
+run_tests();
+
+__DATA__
+
+=== TEST 1: sanity
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local fake_uri = "http://127.0.0.1:" .. ngx.var.server_port
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback"
+ local conf = {
+ callback_url = callback_url,
+ endpoint_addr = fake_uri,
+ client_id = "7ceb9b7fda4a9061ec1c",
+ client_secret = "3416238e1edf915eac08b8fe345b2b95cdba7e04"
+ }
+ local ok, err = plugin.check_schema(conf)
+ if not ok then
+ ngx.say(err)
+ end
+
+ local conf2 = {
+ callback_url = callback_url .. "/?code=aaa",
+ endpoint_addr = fake_uri,
+ client_id = "7ceb9b7fda4a9061ec1c",
+ client_secret = "3416238e1edf915eac08b8fe345b2b95cdba7e04"
+ }
+ ok, err = plugin.check_schema(conf2)
+ if ok then
+ ngx.say("err: shouldn't have passed sanity check")
+ end
+
+ local conf3 = {
+ callback_url = callback_url,
+ endpoint_addr = fake_uri .. "/",
+ client_id = "7ceb9b7fda4a9061ec1c",
+ client_secret = "3416238e1edf915eac08b8fe345b2b95cdba7e04"
+ }
+ ok, err = plugin.check_schema(conf3)
+ if ok then
+ ngx.say("err: shouldn't have passed sanity check")
+ end
+
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 2: enable plugin test redirect
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local t = require("lib.test_admin").test
+
+ local fake_uri = "http://127.0.0.1:10420"
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback"
+ local code, body = t('/apisix/admin/routes/1',
+ ngx.HTTP_PUT,
+ [[{
+ "methods": ["GET"],
+ "uri": "/anything/*",
+ "plugins": {
+ "authz-casdoor": {
+ "callback_url":"]] .. callback_url .. [[",
+ "endpoint_addr":"]] .. fake_uri .. [[",
+ "client_id":"7ceb9b7fda4a9061ec1c",
+ "client_secret":"3416238e1edf915eac08b8fe345b2b95cdba7e04"
+ }
+ },
+ "upstream": {
+ "type": "roundrobin",
+ "nodes": {
+ "httpbin.org:80": 1
+ }
+ }
+ }]]
+ )
+ if code >= 300 then
+ ngx.say("failed to set up routing rule")
+ end
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 3: test redirect
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local t = require("lib.test_admin").test
+
+ local code, body = t('/anything/d?param1=foo¶m2=bar', ngx.HTTP_GET, [[]])
+ if code ~= 302 then
+ ngx.say("should have redirected")
+ end
+
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 4: enable fake casdoor
+--- config
+ location /t {
+ content_by_lua_block {
+ local t = require("lib.test_admin").test
+ local code, body = t('/apisix/admin/routes/2',
+ ngx.HTTP_PUT,
+ [[{
+ "uri": "/api/login/oauth/access_token",
+ "upstream": {
+ "nodes": {
+ "127.0.0.1:1980": 1
+ },
+ "type": "roundrobin"
+ }
+ }]]
+ )
+
+ if code >= 300 then
+ ngx.status = code
+ end
+ ngx.say(body)
+ }
+ }
+--- response_body
+passed
+
+
+
+=== TEST 5: test fake casdoor
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local t = require("lib.test_admin").test
+ local httpc = require("resty.http").new()
+ local cjson = require("cjson")
+ local fake_uri = "http://127.0.0.1:10420/api/login/oauth/access_token"
+
+ local res, err = httpc:request_uri(fake_uri, {method = "GET"})
+ if not res then
+ ngx.say(err)
+ end
+ local data = cjson.decode(res.body)
+ if not data then
+ ngx.say("invalid res.body")
+ end
+ if not data.access_token == "aaaaaaaaaaaaaaaa" then
+ ngx.say("invalid token")
+ end
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 6: test code handling
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local core = require("apisix.core")
+ local log = core.log
+ local t = require("lib.test_admin").test
+ local cjson = require("cjson")
+ local fake_uri = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/d?param1=foo¶m2=bar"
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback?code=aaa&state="
+
+ local httpc = require("resty.http").new()
+ local res1, err1 = httpc:request_uri(fake_uri, {method = "GET"})
+ if not res1 then
+ ngx.say(err1)
+ end
+
+ local cookie = res1.headers["Set-Cookie"]
+ local re_url = res1.headers["Location"]
+ local m, err = ngx.re.match(re_url, "state=([0-9]*)")
+ if err or not m then
+ log.error(err)
+ ngx.exit()
+ end
+ local state = m[1]
+
+ local res2, err2 = httpc:request_uri(callback_url..state, {
+ method = "GET",
+ headers = {Cookie = cookie}
+ })
+ if not res2 then
+ ngx.say(err2)
+ end
+ if res2.status ~= 302 then
+ log.error(res2.status)
+ end
+
+ local cookie2 = res2.headers["Set-Cookie"]
+ local res3, err3 = httpc:request_uri(fake_uri, {
+ method = "GET",
+ headers = {Cookie = cookie2}
+
+ })
+ if not res3 then
+ ngx.say(err3)
+ end
+ if res3.status >= 300 then
+ log.error(res3.status,res3.headers["Location"])
+ end
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+
+
+
+=== TEST 7: incorrect test code handling
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local t = require("lib.test_admin").test
+ local cjson = require("cjson")
+
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback?code=aaa&state=bbb"
+
+ local httpc = require("resty.http").new()
+ local res1, err1 = httpc:request_uri(callback_url, {method = "GET"})
+ if res1.status ~= 503 then
+ ngx.say(res1.status)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+done
+--- error_log
+no session found
+
+
+
+=== TEST 8: incorrect state handling
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local core = require("apisix.core")
+ local log = core.log
+ local t = require("lib.test_admin").test
+ local cjson = require("cjson")
+ local fake_uri = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/d?param1=foo¶m2=bar"
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback?code=aaa&state="
+
+ local httpc = require("resty.http").new()
+ local res1, err1 = httpc:request_uri(fake_uri, {method = "GET"})
+ if not res1 then
+ ngx.say(err1)
+ end
+
+ local cookie = res1.headers["Set-Cookie"]
+ local re_url = res1.headers["Location"]
+ local m, err = ngx.re.match(re_url, "state=([0-9]*)")
+ if err or not m then
+ log.error(err)
+ end
+ local state = m[1]+10
+
+ local res2, err2 = httpc:request_uri(callback_url..state, {
+ method = "GET",
+ headers = {Cookie = cookie}
+ })
+ if not res2 then
+ ngx.say(err2)
+ end
+ if res2.status ~= 302 then
+ log.error(res2.status)
+ end
+
+ local cookie2 = res2.headers["Set-Cookie"]
+ local res3, err3 = httpc:request_uri(fake_uri, {
+ method = "GET",
+ headers = {Cookie = cookie2}
+ })
+ if not res3 then
+ ngx.say(err3)
+ end
+ if res3.status ~= 503 then
+ log.error(res3.status)
+ end
+ ngx.say("done")
+
+ }
+ }
+--- response_body
+done
+--- error_log
+invalid state
+
+
+
+=== TEST 9: test incorrect access_token
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.authz-casdoor")
+ local core = require("apisix.core")
+ local log = core.log
+ local t = require("lib.test_admin").test
+ local cjson = require("cjson")
+ local fake_uri = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/d?param1=foo¶m2=bar"
+ local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
+ "/anything/callback?code=wrong&state="
+
+ local httpc = require("resty.http").new()
+ local res1, err1 = httpc:request_uri(fake_uri, {method = "GET"})
+ if not res1 then
+ ngx.say(err1)
+ end
+
+ local cookie = res1.headers["Set-Cookie"]
+ local re_url = res1.headers["Location"]
+ local m, err = ngx.re.match(re_url, "state=([0-9]*)")
+ if err or not m then
+ log.error(err)
+ ngx.exit()
+ end
+ local state = m[1]
+
+ local res2, err2 = httpc:request_uri(callback_url..state, {
+ method = "GET",
+ headers = {Cookie = cookie}
+ })
+ if not res2 then
+ ngx.say(err2)
+ end
+ if res2.status ~= 302 then
+ log.error(res2.status)
+ end
+
+ local cookie2 = res2.headers["Set-Cookie"]
+ local res3, err3 = httpc:request_uri(fake_uri, {
+ method = "GET",
+ headers = {Cookie = cookie2}
+
+ })
+ if not res3 then
+ ngx.say(err3)
+ end
+ if res3.status ~= 503 then
+ log.error(res3.status)
+ end
+ ngx.say("done")
+ }
+ }
+--- response_body
+done
+--- error_log
+failed when accessing token: invalid access_token