[GitHub] [apisix] moonming commented on a diff in pull request #9147: feat(cli): support APISIX_BYPASS_ADMIN_API_AUTH

["moonming (via GitHub)" <gi...@apache.org>]

moonming commented on code in PR #9147:
URL: https://github.com/apache/apisix/pull/9147#discussion_r1151553333


##########
apisix/admin/init.lua:
##########
@@ -66,6 +67,12 @@ local router
 
 
 local function check_token(ctx)
+    -- check if APISIX_BYPASS_ADMIN_API_AUTH=true
+    local none_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")

Review Comment:
   ```suggestion
       local bypass_admin_api_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")
   ```



##########
t/admin/token.t:
##########
@@ -177,3 +177,21 @@ PUT /apisix/admin/plugins/reload?api_key=4054f7cf07e344346cd3f287985e76a2
 --- request
 GET /apisix/admin/routes??api_key=4054f7cf07e344346cd3f287985e76a2
 --- error_code: 401
+
+
+
+=== TEST 10: access without api key
+--- request
+GET /apisix/admin/routes
+--- error_code: 401
+
+
+
+=== TEST 11: access without api key, but APISIX_BYPASS_ADMIN_API_AUTH=true
+--- main_config
+env APISIX_BYPASS_ADMIN_API_AUTH=true;

Review Comment:
   need to add test cases for `APISIX_BYPASS_ADMIN_API_AUTH` is not `true`



##########
t/admin/token.t:
##########
@@ -177,3 +177,21 @@ PUT /apisix/admin/plugins/reload?api_key=4054f7cf07e344346cd3f287985e76a2
 --- request
 GET /apisix/admin/routes??api_key=4054f7cf07e344346cd3f287985e76a2
 --- error_code: 401
+
+
+
+=== TEST 10: access without api key
+--- request
+GET /apisix/admin/routes
+--- error_code: 401
+
+
+
+=== TEST 11: access without api key, but APISIX_BYPASS_ADMIN_API_AUTH=true
+--- main_config
+env APISIX_BYPASS_ADMIN_API_AUTH=true;

Review Comment:
   and if we set `APISIX_BYPASS_ADMIN_API_AUTH` to `abc`, what will happen? 



##########
apisix/cli/ops.lua:
##########
@@ -190,6 +190,15 @@ local function init(env)
         checked_admin_key = true
     end
 
+    -- check if APISIX_BYPASS_ADMIN_API_AUTH=true
+    local allow_none_auth = getenv("APISIX_BYPASS_ADMIN_API_AUTH")
+    if allow_none_auth == "true" then
+        checked_admin_key = true
+        print("Warning! AdminKey is bypassed because of APISIX_BYPASS_ADMIN_API_AUTH=true.",
+            "If you are deploying APISIX in a production environment,",
+            "please disable it and set a secure password for the adminKey!")
+    end
+

Review Comment:
   Why are there duplicate codes?



##########
t/admin/token.t:
##########
@@ -177,3 +177,21 @@ PUT /apisix/admin/plugins/reload?api_key=4054f7cf07e344346cd3f287985e76a2
 --- request
 GET /apisix/admin/routes??api_key=4054f7cf07e344346cd3f287985e76a2
 --- error_code: 401
+
+
+
+=== TEST 10: access without api key
+--- request
+GET /apisix/admin/routes
+--- error_code: 401
+
+
+
+=== TEST 11: access without api key, but APISIX_BYPASS_ADMIN_API_AUTH=true
+--- main_config
+env APISIX_BYPASS_ADMIN_API_AUTH=true;

Review Comment:
   do we have a schema check for these configures?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org