-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(basic-auth): add missing www-authenticate headers #11795
Merged
kikito
merged 1 commit into
master
from
feat/implement-missing-www-authenticate-headers-basic-auth
Jan 22, 2024
Merged
fix(basic-auth): add missing www-authenticate headers #11795
kikito
merged 1 commit into
master
from
feat/implement-missing-www-authenticate-headers-basic-auth
Jan 22, 2024
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This was referenced Oct 19, 2023
nowNick
commented
Oct 19, 2023
This was referenced Oct 23, 2023
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
November 8, 2023 16:46
e451320
to
de31747
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
2 times, most recently
from
November 8, 2023 17:23
6fb3c59
to
1aa4983
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
November 8, 2023 17:35
1aa4983
to
ccd2a94
Compare
hanshuebner
approved these changes
Nov 9, 2023
kikito
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
November 13, 2023 13:24
56493e3
to
cf4197d
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
November 14, 2023 16:28
cf4197d
to
f163e3a
Compare
kikito
approved these changes
Nov 27, 2023
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approved with a small comment
spec/01-unit/01-db/01-schema/11-declarative_config/02-process_auto_fields_spec.lua
Show resolved
Hide resolved
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
December 5, 2023 08:30
f163e3a
to
b543952
Compare
@nowNick there are conflicts in this PR, can you check please? |
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
January 2, 2024 14:33
b543952
to
abd13e4
Compare
nowNick
force-pushed
the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
from
January 11, 2024 14:08
4a2974e
to
54bdfb8
Compare
kikito
approved these changes
Jan 22, 2024
kikito
deleted the
feat/implement-missing-www-authenticate-headers-basic-auth
branch
January 22, 2024 12:23
nowNick
added
the
cherry-pick kong-ee
schedule this PR for cherry-picking to kong/kong-ee
label
Jan 25, 2024
Cherry-pick failed for Please cherry-pick the changes locally. git remote add upstream https://github.com/kong/kong-ee
git fetch upstream master
git worktree add -d .worktree/cherry-pick-11795-to-master-to-upstream upstream/master
cd .worktree/cherry-pick-11795-to-master-to-upstream
git checkout -b cherry-pick-11795-to-master-to-upstream
ancref=$(git merge-base 15d6f4cec8f6253ff73f157cb37d1a2cdce8cb94 54bdfb8494166ff357f55486b15e3965101597b6)
git cherry-pick -x $ancref..54bdfb8494166ff357f55486b15e3965101597b6 |
flrgh
added a commit
to Kong/go-kong
that referenced
this pull request
Mar 26, 2024
A new `realm` field was recently added to the basic-auth plugin: Kong/kong#11795 To address this I added version awareness to the test cases.
flrgh
added a commit
to Kong/go-kong
that referenced
this pull request
Apr 1, 2024
A new `realm` field was recently added to the basic-auth plugin: Kong/kong#11795 To address this I added version awareness to the test cases.
flrgh
added a commit
to Kong/go-kong
that referenced
this pull request
Apr 1, 2024
A new `realm` field was recently added to the basic-auth plugin: Kong/kong#11795 To address this I added version awareness to the test cases.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
cherry-pick kong-ee
schedule this PR for cherry-picking to kong/kong-ee
plugins/basic-auth
schema-change-noteworthy
size/M
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
When kong returns
401 Unauthorized
response it should returnWWW-Authenticate
header with proper challenge. Basic auth was missing this header on some responses. Previously it only returned this header whenAuthorization
orProxy-Authorization
was missing but the RFC states that it should return it for every 401 response. This PR also adds a possibility to configure a parameter - realm (defaults toservice
).Related PRs:
RFCs & Materials
Checklist
changelog/unreleased/kong
orskip-changelog
label added on PR if changelog is unnecessary. README.mdThere is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HEREFull changelog
WWW-Authenticate
header to all basic-auth 401 responseIssue reference