You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@apisix.apache.org by "waterWang (via GitHub)" <gi...@apache.org> on 2026/08/26 08:02:27 UTC

[PR] fix(basic-auth): reject empty consumer password and fail closed [fj4WqyCCw3C5ShR1RfB7MoBPTpkRrBFYP1uT35g3MvT] [apisix]

waterWang opened a new pull request, #13883:
URL: https://github.com/apache/apisix/pull/13883

### Summary

Fixes #13881 — `basic-auth` currently accepts a consumer with an empty password, allowing passwordless access.

RFC 8265 section 4.1 (the OpaqueString password profile referenced by RFC 7617) requires a password to be non-zero-length. Today the Admin API accepts `password: ""` because `consumer_schema.password` is declared as plain `{ type = "string" }` with no `minLength`. Such a consumer authenticates, so it looks protected while it effectively has no secret. Once #13836 lands (split on the first colon per RFC 7617), `user:` would also return 200 for such a consumer.

### Changes

- **`apisix/plugins/basic-auth.lua`**
- Add `minLength = 1` to `consumer_schema.password` so the Admin API rejects empty passwords on consumer create/update.
- Fail closed in `find_consumer` when either the presented or the resolved password is empty. This also covers existing empty-password consumers and `$secret://` / `$ENV://` references that resolve to `""`.

- **`t/plugin/basic-auth.t`** — regression tests:
- consumer schema rejects an empty password
- Admin API rejects a consumer with an empty password (400)
- `foo:` (empty password) returns 401
- whitespace-only password (`foo: `) returns 401

### Compatibility with #13836

This change is orthogonal to #13836 (which fixes parsing to split on the first colon). With or without #13836, an empty/whitespace-only password now fails closed with a 401.

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(basic-auth): reject empty consumer password and fail closed [apisix]

Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.

juzhiyuan commented on PR #13883:
URL: https://github.com/apache/apisix/pull/13883#issuecomment-5436553696

   Thanks but this issue has been fixed by another PR :)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(basic-auth): reject empty consumer password and fail closed [apisix]

Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.

juzhiyuan closed pull request #13883: fix(basic-auth): reject empty consumer password and fail closed
URL: https://github.com/apache/apisix/pull/13883


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org