You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2020/10/21 16:38:48 UTC
[GitHub] [apisix] Firstsawyou opened a new issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Firstsawyou opened a new issue #2490:
URL: https://github.com/apache/apisix/issues/2490
### Issue description
In the process of using the `hmac-auth` plugin, we do not want the request header data related to the plugin to be sent to the upstream service, because this is data that the upstream does not care about.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] moonming commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
moonming commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714228942
@Firstsawyou What are the http headers related to this plugin? Where is the unified definition and management?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714166615
> Why delete these request headers? Are there any protocol specifications?
These request headers are related to the `hmac-auth` plugin, and upstream does not need to care about their existence (except `access-key`).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] gxthrj commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
gxthrj commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714258907
1. We often use the first way to do hmac verification, and the headers are displayed separately.
When the verification is successful, we keep the `X-HMAC-ACCESS-KEY`, and remove `X-HMAC-SIGNATURE` `X-HMAC-ALGORITHM` `X-HMAC-SIGNED-HEADERS`.
2. I'm not sure if the way of putting the signature information together in the Authorization field is standard usage.
But in this way, We need to discuss how to deal with `Authorization`.
I suggest to remove header `Authorization` and add header `X-HMAC-ACCESS-KEY`.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
membphis commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-715662053
@Firstsawyou please update the description about this issue, it makes me confused.
what is the final result?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] imjoey commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
imjoey commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714950523
> > > X-HMAC-ACCESS-KEY,
> > > X-HMAC-SIGNATURE,
> > > X-HMAC-ALGORITHM,
> > > X-HMAC-SIGNED-HEADERS,
> > > Date
> >
> >
> > I think we can remove `X-HMAC-SIGNATURE`, `X-HMAC-ALGORITHM` and `X-HMAC-SIGNED-HEADERS`.
> > And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
>
> Why do we need to keep the `date`, upstream should not need it. I don't understand here?
`Date` is a general and commonly used HTTP header, so we would better not remove it beforehand from the request sent to upstreams.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] gxthrj commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
gxthrj commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714305379
> > I think after parsing `Authorization`, we can get the value of `access-key` and add ʻaccess-key`to the http request header. Then`Authorization` can be removed.
>
> Or we do not support the way of putting the signature information together in the Authorization field.
> I didn't find any benefits for this.
>
> 1. Hidden the header organization order.
> 2. There is no corresponding header name definition.
> 3. `access-key` as the user flag should not be hidden in `Authorization`.
I create a new issue #2496 to discuss.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] moonming commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
moonming commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-713975988
Why delete these request headers? Are there any protocol specifications?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714340056
> > X-HMAC-ACCESS-KEY,
> > X-HMAC-SIGNATURE,
> > X-HMAC-ALGORITHM,
> > X-HMAC-SIGNED-HEADERS,
> > Date
>
> I think we can remove `X-HMAC-SIGNATURE`, `X-HMAC-ALGORITHM` and `X-HMAC-SIGNED-HEADERS`.
>
> And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
Why do we need to keep the `date`, upstream should not need it. I don't understand here?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
membphis commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714333325
> X-HMAC-ACCESS-KEY,
> X-HMAC-SIGNATURE,
> X-HMAC-ALGORITHM,
> X-HMAC-SIGNED-HEADERS,
> Date
I think we can remove `X-HMAC-SIGNATURE`, `X-HMAC-ALGORITHM` and `X-HMAC-SIGNED-HEADERS`.
And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
membphis commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-715380056
> @Firstsawyou `Date` is a general and commonly used HTTP header, so we would better not remove it beforehand from the request sent to upstreams.
agree with this. that is my reason too.
> And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
@gxthrj please help me to confirm if the upstream service need `X-HMAC-ACCESS-KEY`, I can not sure about this.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714242875
> W
There are two ways to define request headers related to the `hmac-auth` plugin:
1. The signature information is separately placed in the request header
Related request headers are(plugin default):
```
X-HMAC-ACCESS-KEY,
X-HMAC-SIGNATURE,
X-HMAC-ALGORITHM,
X-HMAC-SIGNED-HEADERS,
Date
```
The `X-HMAC-SIGNED-HEADERS` is of the `array` type and can have multiple request headers.
These request header names have default values in the plugin, and can also be customized in the `conf / config.yaml` file.
2. Put the signature information together in the Authorization field of the request header
Related request headers are:
```
Authorization,
X-HMAC-SIGNED-HEADERS
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-715926111
> @Firstsawyou please update the description about this issue, it makes me confused.
Thanks for your suggestion, the description has been updated.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] gxthrj commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
gxthrj commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714273946
> I think after parsing `Authorization`, we can get the value of `access-key` and add ʻaccess-key`to the http request header. Then`Authorization` can be removed.
Or we do not support the way of putting the signature information together in the Authorization field.
I didn't find any benefits for this.
1. Hidden the header organization order.
2. There is no corresponding header name definition.
3. `access-key` as the user flag should not be hidden in `Authorization`.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714360724
Do we need to add a switch option in `schema` to control the deletion of HTTP request headers?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-715404065
> > > > X-HMAC-ACCESS-KEY,
> > > > X-HMAC-SIGNATURE,
> > > > X-HMAC-ALGORITHM,
> > > > X-HMAC-SIGNED-HEADERS,
> > > > Date
> > >
> > >
> > > I think we can remove `X-HMAC-SIGNATURE`, `X-HMAC-ALGORITHM` and `X-HMAC-SIGNED-HEADERS`.
> > > And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
> >
> >
> > Why do we need to keep the `date`, upstream should not need it. I don't understand here?
>
> @Firstsawyou `Date` is a general and commonly used HTTP header, so we would better not remove it beforehand from the request sent to upstreams.
Thank you for answering, I understand.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] gxthrj commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
gxthrj commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714167917
There are the following considerations for deleting the hmac signature header:
1. To be safe, hide these headers
2. Follow-up logic and upstream do not need these fields
but access-key is useful，it can not be remove.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714243171
> @Firstsawyou What are the http headers related to this plugin? Where is the unified definition and management?
There are two ways to define request headers related to the `hmac-auth` plugin:
1. The signature information is separately placed in the request header
Related request headers are(plugin default):
```
X-HMAC-ACCESS-KEY,
X-HMAC-SIGNATURE,
X-HMAC-ALGORITHM,
X-HMAC-SIGNED-HEADERS,
Date
```
The `X-HMAC-SIGNED-HEADERS` is of the `array` type and can have multiple request headers.
These request header names have default values in the plugin, and can also be customized in the `conf / config.yaml` file.
2. Put the signature information together in the Authorization field of the request header
Related request headers are:
```
Authorization,
X-HMAC-SIGNED-HEADERS
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis closed issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
membphis closed issue #2490:
URL: https://github.com/apache/apisix/issues/2490
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] imjoey edited a comment on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
imjoey edited a comment on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714950523
> > > X-HMAC-ACCESS-KEY,
> > > X-HMAC-SIGNATURE,
> > > X-HMAC-ALGORITHM,
> > > X-HMAC-SIGNED-HEADERS,
> > > Date
> >
> >
> > I think we can remove `X-HMAC-SIGNATURE`, `X-HMAC-ALGORITHM` and `X-HMAC-SIGNED-HEADERS`.
> > And we should keep `X-HMAC-ACCESS-KEY` and `Date`. what do you think? @gxthrj @Firstsawyou
>
> Why do we need to keep the `date`, upstream should not need it. I don't understand here?
@Firstsawyou `Date` is a general and commonly used HTTP header, so we would better not remove it beforehand from the request sent to upstreams.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou edited a comment on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou edited a comment on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714243171
> @Firstsawyou What are the http headers related to this plugin? Where is the unified definition and management?
There are two ways to define request headers related to the `hmac-auth` plugin:
1. The signature information is separately placed in the request header
Related request headers are(plugin default):
```
X-HMAC-ACCESS-KEY,
X-HMAC-SIGNATURE,
X-HMAC-ALGORITHM,
X-HMAC-SIGNED-HEADERS,
Date
```
The `X-HMAC-SIGNED-HEADERS` is of the `array` type and can have multiple request headers.
These request header names have default values in the plugin, and can also be customized in the `conf / config.yaml` file.
2. Put the signature information together in the Authorization field of the request header
Related request headers are:
```
Authorization
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou commented on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou commented on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714266010
I think after parsing `Authorization`, we can get the value of `access-key` and add ʻaccess-key` to the http request header. Then `Authorization` can be removed.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] membphis edited a comment on issue #2490: discuss: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
membphis edited a comment on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-715662053
@Firstsawyou please update the description about this issue, it makes me confused.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Firstsawyou removed a comment on issue #2490: feat: In the request of the `hmac-auth` plugin, remove the request header related to the plugin
Posted by GitBox <gi...@apache.org>.
Firstsawyou removed a comment on issue #2490:
URL: https://github.com/apache/apisix/issues/2490#issuecomment-714242875
> W
There are two ways to define request headers related to the `hmac-auth` plugin:
1. The signature information is separately placed in the request header
Related request headers are(plugin default):
```
X-HMAC-ACCESS-KEY,
X-HMAC-SIGNATURE,
X-HMAC-ALGORITHM,
X-HMAC-SIGNED-HEADERS,
Date
```
The `X-HMAC-SIGNED-HEADERS` is of the `array` type and can have multiple request headers.
These request header names have default values in the plugin, and can also be customized in the `conf / config.yaml` file.
2. Put the signature information together in the Authorization field of the request header
Related request headers are:
```
Authorization,
X-HMAC-SIGNED-HEADERS
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org