You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "lpiob (via GitHub)" <gi...@apache.org> on 2023/04/21 09:11:14 UTC
[GitHub] [apisix] lpiob opened a new issue, #9351: bug: proxy-rewrite does not work with aws-lambda plugin
lpiob opened a new issue, #9351:
URL: https://github.com/apache/apisix/issues/9351
### Current Behavior
When configuring an ApisixRoute endpoint, the `proxy-rewrite` allows me to for example remove specific request headers.
This works fine, unless the request is routed to AWS Lambda function through `aws-lambda` plugin.
The destination function get triggered successfully, yet the headers are not removed.
### Expected Behavior
`proxy-rewrite` should work the same regardless of the final endpoint
### Error Logs
Some header manipulation code IS running, as can be seen from apisix logs printed while processing request:
```
apisix-5b49f6b74-wvl4r apisix 2023/04/21 09:08:49 [warn] 48#48: *9023948 [lua] request.lua:120: set_header(): DEPRECATED: use set_header(ctx, header_name, header_value) instead, client: 10.200.160.150, server: _, request: "POST /lbiegaj/test HTTP/1.1", host: "api.example.com"
apisix-5b49f6b74-wvl4r apisix 2023/04/21 09:08:49 [warn] 48#48: *9023948 [lua] request.lua:120: set_header(): DEPRECATED: use set_header(ctx, header_name, header_value) instead, client: 10.200.160.150, server: _, request: "POST /lbiegaj/test HTTP/1.1", host: "api.example.com"
apisix-5b49f6b74-wvl4r apisix 2023/04/21 09:08:49 [warn] 48#48: *9023948 [lua] request.lua:120: set_header(): DEPRECATED: use set_header(ctx, header_name, header_value) instead, client: 10.200.160.150, server: _, request: "POST /lbiegaj/test HTTP/1.1", host: "api.example.com"
apisix-5b49f6b74-wvl4r apisix 2023/04/21 09:08:49 [warn] 48#48: *9023948 [lua] request.lua:120: set_header(): DEPRECATED: use set_header(ctx, header_name, header_value) instead, client: 10.200.160.150, server: _, request: "POST /lbiegaj/test HTTP/1.1", host: "api.example.com"
```
### Steps to Reproduce
1. Create an AWS Lambda with function url. Sample code that reflects the received event:
```export const handler = async(event) => {
const response = {
statusCode: 200,
body: JSON.stringify(event),
};
return response;
};
```
2. Configure an ApisixRoute that uses the `proxy-rewrite` and `aws-lambda` plugins.
```
spec:
http:
backends:
- serviceName: lambda
servicePort: 80
match:
methods:
- POST
paths:
- /test/*
name: test
plugins:
- config:
function_uri: https://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.lambda-url.eu-west-3.on.aws/
ssl_verify: false
timeout: 10000
enable: true
name: aws-lambda
- config:
headers:
remove:
- authorization
- User-Agent
enable: true
name: proxy-rewrite
```
4. Send requests and observe that Authorization header is not removed.
### Environment
- APISIX version (run `apisix version`): 3.2.0
- Operating system (run `uname -a`): from official docker image (Linux apisix-5b49f6b74-jkxft 5.10.173-154.642.amzn2.x86_64 #1 SMP Wed Mar 15 00:26:42 UTC 2023 x86_64 GNU/Linux)
Helm charts versions:
- apisix 1.2.0
- apisix-ingress-controller 0.11.3
- etcd 8.7.6
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: proxy-rewrite does not work with aws-lambda plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1871803798
I will consider this issue as resolved, please revert with proper reproduction steps if the issue persists.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: proxy-rewrite does not work with aws-lambda plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1871318464
> Send requests and observe that Authorization header is not removed.
how can you confirm this? P.S: the authorization header is automatically added: https://github.com/shreemaan-abhishek/apisix/blob/105993f40f34768cd0a86035d01393346fff3a94/apisix/plugins/aws-lambda.lua#L178
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1533987386
Should apisix support removing UA?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1596870900
1. the plugin will add the UA header automatically
<img width="673" alt="image" src="https://github.com/apache/apisix/assets/2706161/db236b92-ff04-44a0-989c-a58b495f0c0c">
for this config, it's doesn't work originally.
3. In fact, this UA is provided by the lua-resty-http library, so it is more in line with product practice to remove it at the caller.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] lpiob commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "lpiob (via GitHub)" <gi...@apache.org>.
lpiob commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1521825486
I've injected my `generic-upstream.lua` with the same debug code and I can see that both the Authorization and User-Agent headers are forwarded.
```apisix-5b49f6b74-jkxft apisix 2023/04/25 13:22:49 [error] 252#252: *67998175 [lua] generic-upstream.lua:111: phase_func(): sn0rt generic headers: {"authorization":"Basic V<removed>w==","user-agent":"curl/7.88.1"
```
Just to verify the config (mine was entered through apisix-ingress-controller), here's mine:
```
$ curl -sH "X-API-Key: <removed>" http://apisix-admin.apisix.svc.cluster.local:9180/apisix/admin/routes/b94dc773 | jq
{
"createdIndex": 190619,
"modifiedIndex": 190619,
"value": {
"plugins": {
"aws-lambda": {
"keepalive": true,
"accesskey": "AKI<removed>",
"secretkey": "<removed>",
"keepalive_timeout": 60000,
"authorization.iam.service": "lambda",
"authorization": {
"iam": {
"service": "lambda",
"accesskey": "<removed>",
"aws_region": "eu-west-3",
"secretkey": "<removed>"
}
},
"authorization.iam.accesskey": "<removed>",
"function_uri": "https://<removed>.lambda-url.eu-west-3.on.aws/",
"ssl_verify": false,
"authorization.iam.secretkey": "<removed>",
"authorization.iam.aws_region": "eu-west-3",
"timeout": 10000,
"service": "lambda",
"aws_region": "eu-west-3",
"keepalive_pool": 5
},
"basic-auth": {
"hide_credentials": false
},
"proxy-rewrite": {
"headers": {
"remove": [
"User-Agent",
"authorization",
"Authorization"
]
},
"use_real_request_uri_unsafe": false
}
},
"id": "b94dc773",
"desc": "Created by apisix-ingress-controller, DO NOT modify it manually",
"update_time": 1682429494,
"name": "removed_lbiegaj-test_lbiegaj",
"upstream_id": "3c4c019c",
"create_time": 1682429494,
"priority": 0,
"labels": {
"managed-by": "apisix-ingress-controller"
},
"uris": [
"/lbiegaj/*"
],
"status": 1,
"methods": [
"POST"
]
},
"key": "/apisix/routes/b94dc773"
}
```
The proxy-rewrite is matching your configuration.
What's interesting, by checking the route definition I've noticed the `hide_credentials` config parameter in basic-auth plugin that I am using. Even after enabling it, the Authorization headers is forwarded, so maybe it's being set by some other plugin?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1649211385
@lpiob Is this problem solved now?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: proxy-rewrite does not work with aws-lambda plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1871800643
I used proxy-rewrite to modify the `uri` from `/awss` to `/aws` and it worked:
```perl
=== TEST 1: create route with aws plugin enabled
--- config
location /t {
content_by_lua_block {
local t = require("lib.test_admin").test
local code, body = t('/apisix/admin/routes/1',
ngx.HTTP_PUT,
[[{
"plugins": {
"aws-lambda": {
"function_uri": "http://localhost:8765/httptrigger",
"authorization": {
"apikey" : "testkey"
}
},
"proxy-rewrite": {
"uri": "/aws",
"headers": {
"add": {
"aaa": "112233"
}
}
}
},
"uri": "/awss"
}]]
)
if code >= 300 then
ngx.status = code
ngx.say("fail")
return
end
ngx.say(body)
}
}
--- response_body
passed
=== TEST 2: test plugin endpoint
--- config
location /t {
content_by_lua_block {
local t = require("lib.test_admin").test
local core = require("apisix.core")
local code, _, body, headers = t("/awss", "GET")
if code >= 300 then
ngx.status = code
ngx.say(body)
return
end
-- headers proxied 2 times -- one by plugin, another by this test case
core.response.set_header(headers)
ngx.print(body)
}
}
--- response_body
aws lambda invoked
--- response_headers
Content-Length: 19
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] lpiob commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "lpiob (via GitHub)" <gi...@apache.org>.
lpiob commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1596722022
@Sn0rt I don't see any reason why would anyone need to remove the UA. Headers take part in calculation of AWS_IAM authorization, and AWS recommends using as many headers as possible/available. Besides, why choose to drop the UA in aws-lambda and not in some other plugin?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1518931789
I think the reason is the aws-lambda is a stream-type plugin and the proxy-rewrite is an HTTP plugin. It works in a different phase.
and the HTTP plugin always runs it first.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] soulbird commented on issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
Posted by "soulbird (via GitHub)" <gi...@apache.org>.
soulbird commented on issue #9351:
URL: https://github.com/apache/apisix/issues/9351#issuecomment-1534000932
It is better to add a configuration
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] bug: proxy-rewrite does not work with aws-lambda plugin [apisix]
Posted by "shreemaan-abhishek (via GitHub)" <gi...@apache.org>.
shreemaan-abhishek closed issue #9351: bug: proxy-rewrite does not work with aws-lambda plugin
URL: https://github.com/apache/apisix/issues/9351
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org