fix(auth): carry the request context on every authentication denial - #904
Conversation
A 401 short-circuits in the extractor, ahead of every handler, so it reaches no access-log emit — deliberately, since an internet-facing DP would drown in scanner probes (AISIX-Cloud#1081). That leaves `aisix_auth_decisions_total` as the only record, and it answers "how many" without "who, when, against what": no caller address, no route, no request id, no timestamp. The denial log lines that do exist carried just the reason class, so raising `aisix::auth` to debug — the one move an operator makes when investigating "who is hammering us with a bad key" — produced lines that still identified nothing. Each denial now carries the caller's resolved address, the HTTP method and path, and the request id; `key_disabled` / `key_expired` also name the key, since those denials are about a key an operator provisioned. Levels are unchanged: the scanner-probe shapes (`missing_credentials`, `unknown_key`, and the JWT pre-verification reasons) stay at debug, so the default level is as quiet as before.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 29 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
Comment |
1 participant
问题
401 在 extractor 里短路，跑在所有 handler 之前，因此不会走到任何 access log 的 emit 点——这是 AISIX-Cloud#1081 有意的取舍：面向公网的 DP 会被扫描探测刷屏。代价是
aisix_auth_decisions_total成了唯一的记录，而它只能回答"有多少次"，回答不了"谁、什么时候、打的哪个路由"：没有来源地址、没有路由、没有 request id、没有时间戳。现有的拒绝日志行只带了 reason 分类。也就是说运维在排查"谁在拿错误 key 打网关"时把
aisix::auth调到 debug（这正是唯一能做的动作），拿到的行依然什么都识别不了。实现
每条认证拒绝日志补上请求上下文：解析后的调用方地址（走既有的
real_ip可信代理配置）、HTTP method 与 path、request id。key_disabled/key_expired额外带上api_key_id——这两类拒绝针对的是运维自己发过的 key，下一步动作就是去查它。日志级别一概不变：扫描探测形态（
missing_credentials、unknown_key，以及 JWT 验签前的几类拒绝）仍在 debug，默认级别下的噪音和改动前完全一致。ClientContext里解析来源 IP 的逻辑提取成client_ip::source_ip_from_parts，auth extractor 复用它（auth 跑在ClientContext之前，不能依赖它的结果）。JWT 侧 12 个deny调用点通过一个Denier { state, ctx }参数捆绑传入，调用点仍是一个参数宽。测试
auth.rs新增三条单测，用捕获 subscriber 断言实际输出的日志行：未知 key、无凭据、被禁用的 key，各自必须带上source_ip/path/request_id（被禁用的还要带 key id）。请求里注入了ConnectInfo，走的是真实的地址解析路径。回归：
cargo test -p aisix-proxy --lib849 项全过，clippy-D warnings干净。