-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(key-auth): keep query params order if hide_credentials is true
When hide_credentials=true, query parameters should not be sorted alphabetically. This alters the original request and can have unintended consequences for upstream services. One example is authentication with the pseudo header (request-target) as described in https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures#section-2.3. Since the order is not preserved, the signature does not match and the upstream rejects the request. * query parameters order is not altered when hide_credentials=true * add two new test cases in spec/03-plugins/09-key-auth
- Loading branch information
1 parent
6f0263b
commit bf78534
Showing
3 changed files
with
47 additions
and
4 deletions.
There are no files selected for viewing
3 changes: 3 additions & 0 deletions
3
changelog/unreleased/kong/fix-key-auth-query-params-order.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
message: "keep query params order in key-auth plugin if hide_credentials is true" | ||
type: bugfix | ||
scope: Plugin |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters