feat: support hide credentials for jwt-auth plugin

apisix/plugins/jwt-auth.lua

@@ -19,13 +19,17 @@ local jwt      = require("resty.jwt")
 local consumer_mod = require("apisix.consumer")
 local resty_random = require("resty.random")
 local vault        = require("apisix.core.vault")
+local new_tab = require ("table.new")
 
 local ngx_encode_base64 = ngx.encode_base64
 local ngx_decode_base64 = ngx.decode_base64
 local ipairs   = ipairs
 local ngx      = ngx
 local ngx_time = ngx.time
 local sub_str  = string.sub
+local table_insert = table.insert
+local table_concat = table.concat
+local ngx_re_gmatch = ngx.re.gmatch
 local plugin_name = "jwt-auth"
 local pcall = pcall
 
@@ -48,6 +52,10 @@ local schema = {
         cookie = {
             type = "string",
             default = "jwt"
+        },
+        hide_credentials = {
+            type = "boolean",
+            default = false
         }
     },
 }
@@ -188,10 +196,41 @@ function _M.check_schema(conf, schema_type)
     return true
 end
 
+local function remove_specified_cookie(src, key)
+    local cookie_key_pattern = "([a-zA-Z0-9-_]*)"
+    local cookie_val_pattern = "([a-zA-Z0-9-._]*)"
+    local t = new_tab(1, 0)
+
+    local it, err = ngx_re_gmatch(src, cookie_key_pattern .. "=" .. cookie_val_pattern, "jo")
+    if not it then
+        core.log.error("match origins failed: ", err)
+        return src
+    end
+    while true do
+        local m, err = it()
+        if err then
+            core.log.error("iterate origins failed: ", err)
+            return src
+        end
+        if not m then
+            break
+        end
+        if m[1] ~= key then
+            table_insert(t, m[0])
+        end
+    end
+
+    return table_concat(t, "; ")
+end
 
 local function fetch_jwt_token(conf, ctx)
     local token = core.request.header(ctx, conf.header)
     if token then
+        if conf.hide_credentials then
+            -- hide for header
+            core.request.set_header(ctx, conf.header, nil)
+        end
+
         local prefix = sub_str(token, 1, 7)
         if prefix == 'Bearer ' or prefix == 'bearer ' then
             return sub_str(token, 8)
@@ -200,15 +239,29 @@ local function fetch_jwt_token(conf, ctx)
         return token
     end
 
-    token = ctx.var["arg_" .. conf.query]
+    local uri_args = core.request.get_uri_args(ctx) or {}
+    token = uri_args[conf.query]
     if token then
+        if conf.hide_credentials then
+            -- hide for query
+            uri_args[conf.query] = nil
+            core.request.set_uri_args(ctx, uri_args)
+        end
         return token
     end
 
     local val = ctx.var["cookie_" .. conf.cookie]
     if not val then
         return nil, "JWT not found in cookie"
     end
+
+    if conf.hide_credentials then
+        -- hide for cookie
+        local src = core.request.header(ctx, "Cookie")
+        local reset_val = remove_specified_cookie(src, conf.cookie)
+        core.request.set_header(ctx, "Cookie", reset_val)
+    end
+
     return val
 end
 
@@ -357,8 +410,8 @@ local function algorithm_handler(consumer, method_only)
     end
 end
 
-
 function _M.rewrite(conf, ctx)
+    -- fetch token and hide credentials if necessary
     local jwt_token, err = fetch_jwt_token(conf, ctx)
     if not jwt_token then
         core.log.info("failed to fetch JWT token: ", err)

docs/en/latest/plugins/basic-auth.md

@@ -46,7 +46,7 @@ For Route:
 
 | Name             | Type    | Required | Default | Description                                                            |
 |------------------|---------|----------|---------|------------------------------------------------------------------------|
-| hide_credentials | boolean | False    | false   | Set to true to pass the authorization request headers to the Upstream. |
+| hide_credentials | boolean | False    | false   | Set to true will not pass the authorization request headers to the Upstream. |
 
 ## Enabling the Plugin
 

docs/en/latest/plugins/jwt-auth.md

@@ -66,6 +66,7 @@ For Route:
 | header | string | False    | authorization | The header to get the token from.                                   |
 | query  | string | False    | jwt           | The query string to get the token from. Lower priority than header. |
 | cookie | string | False    | jwt           | The cookie to get the token from. Lower priority than query.        |
+| hide_credentials | boolean | False     | false  | Set to true will not pass the authorization request of header\query\cookie to the Upstream.|
 
 ## API
 

docs/zh/latest/plugins/basic-auth.md

@@ -46,7 +46,7 @@ Route 端：
 
 | 名称             | 类型     | 必选项 | 默认值  | 描述                                                            |
 | ---------------- | ------- | ------ | ------ | --------------------------------------------------------------- |
-| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则会将 Authorization 请求头传递给 Upstream。|
+| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则不会将 Authorization 请求头传递给 Upstream。|
 
 ## 启用插件
 

docs/zh/latest/plugins/jwt-auth.md

@@ -66,6 +66,7 @@ Route 端：
 | header | string | 否     | authorization | 设置我们从哪个 header 获取 token。                         |
 | query  | string | 否     | jwt           | 设置我们从哪个 query string 获取 token，优先级低于 header。  |
 | cookie | string | 否     | jwt           | 设置我们从哪个 cookie 获取 token，优先级低于 query。        |
+| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则不会将含有认证信息的 header\query\cookie 传递给 Upstream。|
 
 ## 接口