fix(basic-auth): reject an empty consumer password - #13884
Merged
nic-6443 merged 3 commits intoAug 27, 2026
Conversation
The consumer schema accepted `password: ""`, and such a consumer could authenticate with `user: ` (or `user:` once credentials are split on the first colon). Require a non-empty password in the schema and fail closed with 401 when the resolved password is empty, which also covers existing data and secret references that resolve to "". Fixes apache#13881
dosubot
Bot
added
size:L
nic-6443
reviewed
Aug 26, 2026
The consumer schema is enforced on write by the Admin API and on load by plugin_checker, so the runtime empty-password check is redundant. Drop it together with the secret-reference tests that exercised it.
dosubot
Bot
added
size:M
nic-6443
previously approved these changes
Aug 27, 2026
shreemaan-abhishek
previously approved these changes
Aug 27, 2026
Member
|
[P1] Reject passwords that resolve to an empty secret or environment value minLength = 1 only validates the non-empty $secret://... or $env://... reference string. consumer.lua resolves that reference before building the consumer cache, and a resolved empty string is not rejected. basic-auth.lua then compares it directly with the request password, so a Basic header containing the matching username and an empty password can still authenticate when the reference resolves to "". Please reject an empty password after secret/environment resolution, for example in the basic-auth runtime check or by revalidating the resolved consumer config, and add regressions showing $env:// and $secret:// values resolving to "" return the generic 401 response. |
Restore the runtime check dropped in b471cb2: minLength only validates the $secret:// or $env:// reference string, and consumer.lua resolves it after validation, so a reference that resolves to "" would otherwise authenticate `user:`. Add regressions for both $secret:// and $env:// resolving to "".
janiussyafiq
dismissed stale reviews from shreemaan-abhishek and nic-6443
via
August 27, 2026 07:02
7c71988
dosubot
Bot
added
size:L
membphis
approved these changes
Aug 27, 2026
nic-6443
approved these changes
Aug 27, 2026
shreemaan-abhishek
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
basic-authconsumer schema acceptedpassword: "", and such a consumer could authenticate withuser:on the wire (and withuser:once #13836 splits credentials on the first colon).consumer_schema.passwordnow requiresminLength = 1, so the Admin API rejects an empty password on consumers and credentials.$secret:///$env://references that resolve to"".passwordattribute is documented as a non-empty string.Which issue(s) this PR fixes:
Fixes #13881
Checklist