From b098f238e418f313cfe20d84136cc0e92066c51c Mon Sep 17 00:00:00 2001 From: 8r1ef Date: Thu, 9 Jul 2026 21:20:16 +0800 Subject: [PATCH] docs: clarify authz-casbin subject header trust --- docs/en/latest/plugins/authz-casbin.md | 2 ++ docs/zh/latest/plugins/authz-casbin.md | 2 ++ 2 files changed, 4 insertions(+) diff --git a/docs/en/latest/plugins/authz-casbin.md b/docs/en/latest/plugins/authz-casbin.md index d933a824f11c..06f265e09edd 100644 --- a/docs/en/latest/plugins/authz-casbin.md +++ b/docs/en/latest/plugins/authz-casbin.md @@ -48,6 +48,8 @@ You must either specify the `model_path`, `policy_path`, and the `username` attr If you wish to use a global Casbin configuration, you can first specify `model` and `policy` attributes in the Plugin metadata and only the `username` attribute in the Plugin configuration. All Routes will use the Plugin configuration this way. +The `username` attribute names the request header used as the Casbin subject. APISIX does not rewrite or verify this header against an authenticated consumer. If clients can send this header directly, make sure a trusted component at the edge strips, rewrites, or sets it before `authz-casbin` evaluates the request. + ::: ## Metadata diff --git a/docs/zh/latest/plugins/authz-casbin.md b/docs/zh/latest/plugins/authz-casbin.md index 648a99fec6b8..57e65cbc3fe7 100644 --- a/docs/zh/latest/plugins/authz-casbin.md +++ b/docs/zh/latest/plugins/authz-casbin.md @@ -48,6 +48,8 @@ description: 本文介绍了关于 Apache APISIX `authz-casbin` 插件的基本 如果你想要使所有的 Route 共享 Casbin 配置，你可以先在插件元数据中指定 `model` 和 `policy`，在插件配置中仅指定 `username`，这样所有 Route 都可以使用 Casbin 插件配置。 +`username` 属性用于指定作为 Casbin subject 的请求头。APISIX 不会将该请求头与已认证的 consumer 进行改写或校验。如果客户端可以直接发送该请求头，请确保在可信边界处由可信组件先移除、重写或设置该请求头，再交由 `authz-casbin` 进行鉴权。 + :::: ## 元数据