You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "kayx23 (via GitHub)" <gi...@apache.org> on 2025/07/15 09:11:01 UTC
[I] help request: the use of env var in `key-auth` plugin's `key` is not working [apisix]
kayx23 opened a new issue, #12431:
URL: https://github.com/apache/apisix/issues/12431
### Description
From this test case, it looks like the use of env var in `key` is supported in the `key-auth` plugin: https://github.com/apache/apisix/blob/master/t/plugin/key-auth.t#L558-L594
However during testing, the behaviour was unexpected.
## Reproduction
Start the latest APISIX in Docker (3.13.0).
Save the value of the key to an environment variable:
```shell
export JACK_AUTH_KEY=jack-key
```
Create a consumer jack:
```shell
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username": "jack"
}'
```
Configure the `key-auth` credential for jack:
```shell
curl "http://127.0.0.1:9180/apisix/admin/consumers/jack/credentials" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "cred-jack-key-auth",
"plugins": {
"key-auth": {
"key": "$env://JACK_AUTH_KEY"
}
}
}'
```
Create a route and enable `key-auth`:
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "key-auth-route",
"uri": "/anything",
"plugins": {
"key-auth": {}
},
"upstream" : {
"nodes": {
"httpbin.org": 1
}
}
}'
```
Send a request to the route with jack's key:
```shell
curl "http://127.0.0.1:9080/anything" -H 'apikey: jack-key'
```
Here the expectation is to receive an `HTTP/1.1 200 OK` response, but I received an `HTTP/1.1 401 Unauthorized` response:
```
{"message":"Invalid API key in request"}
```
### Environment
- APISIX version (run `apisix version`): 3.13.0 (in Docker)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3101267606
Thanks. All Qs in this issue have been addressed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3101251737
> https://apisix.apache.org/docs/apisix/plugins/jwt-auth/#manage-secrets-in-secret-manager This example has issue as well in the length of the secret and the field that references the secret (should be secret I think, not key). Once these are corrected, I ran into the same error.
When testing according to the document, there are two places that need to be adjusted according to the actual situation:
```
curl "http://127.0.0.1:9180/apisix/admin/secrets/vault/jwt" -X PUT \
-H "X-API-KEY: ${admin_key}" \
-d '{
"uri": "https://127.0.0.1:8200"，
"prefix": "kv/apisix",
"token": "root"
}'
```
Please replace the address in uri with the actual host address and use HTTP.
```
curl "http://127.0.0.1:9180/apisix/admin/consumers/jack/credentials" -X PUT \
-H "X-API-KEY: ${admin_key}" \
-d '{
"id": "cred-jack-jwt-auth",
"plugins": {
"jwt-auth": {
"key": "$secret://vault/jwt/jack/jwt-key",
"secret": "vault-hs256-secret"
}
}
}'
```
When using jwt.io to encode a token, the secret in the example needs to be adjusted due to length restrictions. Please adjust it to a string that meets the length.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3101241474
> https://apisix.apache.org/docs/apisix/plugins/jwt-auth/#manage-secrets-in-environment-variables similarly this example is currently not working (after correcting the hs256 secret length to be longer), and I suspect due to the same reason.
It works fine after passing environment variables to the container using `-e`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3088273805
> The same steps, tested on 3.12.0, work, but not on 3.13.0, this seems to be a bug in version 3.13.0.
Strangely, I can't reproduce this problem. Maybe the previous results were affected by other reasons.
@kayx23 If you are testing with docker, make sure you set the environment variables when starting the container using `-e`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 closed issue #12431: bug: the use of env var in `key-auth` plugin's `key` is not working
URL: https://github.com/apache/apisix/issues/12431
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3076450917
The same steps, tested on 3.12.0, work, but not on 3.13.0, this seems to be a bug in version 3.13.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: the use of env var in `key-auth` plugin's `key` is not working [apisix]
Posted by "kayx23 (via GitHub)" <gi...@apache.org>.
kayx23 commented on issue #12431:
URL: https://github.com/apache/apisix/issues/12431#issuecomment-3077206313
How did the test cases passed then?
https://apisix.apache.org/docs/apisix/plugins/jwt-auth/#manage-secrets-in-environment-variables similarly this example is currently not working (after correcting the hs256 secret length to be longer), and I suspect due to the same reason.
https://apisix.apache.org/docs/apisix/plugins/jwt-auth/#manage-secrets-in-secret-manager This example has issue as well in the length of the secret and the field that references the secret (should be secret I think, not key). Once these are corrected, I ran into the same error.
Suspecting both `$env://` and `$secret://` have issues in 3.13.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org