[BUG] WAF reject rules ignore the configured HTTP status code

[Aias00]

Current Behavior

WAF reject rules expose a configurable statusCode, but the HTTP transport status is always set to 403 Forbidden.

WafHandle includes statusCode and defaults it to 403, but WafPlugin hardcodes the response status:

exchange.getResponse().setStatusCode(HttpStatus.FORBIDDEN);
Object error = ShenyuResultWrap.error(exchange, Integer.parseInt(wafHandle.getStatusCode()), Constants.REJECT_MSG, null);

So a rule configured with another status code only changes the body code, while the actual HTTP status remains 403.

Expected Behavior

The configured WAF statusCode should either be applied to the HTTP response status as well, or the configuration should be removed/renamed so operators do not expect it to control the transport status.

Impact

Operators cannot return custom reject statuses from WAF rules, and clients can observe inconsistent HTTP status and response body code.

Code Location

• shenyu-common/src/main/java/org/apache/shenyu/common/dto/convert/rule/WafHandle.java
• shenyu-plugin/shenyu-plugin-waf/src/main/java/org/apache/shenyu/plugin/waf/WafPlugin.java

[github-actions]

👋 Hello @yuluo-yx

A new issue has been opened by @Aias00:

• Title: [BUG] WAF reject rules ignore the configured HTTP status code
• Link: [BUG] WAF reject rules ignore the configured HTTP status code #6477

Please review when you have time. Thank you! 🙏

[wy471x]

/assign