fix(wolf-rbac): clear upstream identity headers when auth response omits userInfo

apisix/plugins/wolf-rbac.lua

@@ -287,13 +287,17 @@ function _M.rewrite(conf, ctx)
 
     local username = nil
     local nickname = nil
+    local prefix = cur_consumer.auth_conf.header_prefix or ''
+    -- drop client-supplied identity headers before trusting the auth response
+    core.request.set_header(ctx, prefix .. "UserId", nil)
+    core.request.set_header(ctx, prefix .. "Username", nil)
+    core.request.set_header(ctx, prefix .. "Nickname", nil)
     if type(res.userInfo) == 'table' then
         local userInfo = res.userInfo
         ctx.userInfo = userInfo
         local userId = userInfo.id
         username = userInfo.username
         nickname = userInfo.nickname or userInfo.username
-        local prefix = cur_consumer.auth_conf.header_prefix or ''
         core.response.set_header(prefix .. "UserId", userId)
         core.response.set_header(prefix .. "Username", username)
         core.response.set_header(prefix .. "Nickname", ngx.escape_uri(nickname))

t/lib/server.lua

@@ -323,6 +323,9 @@ function _M.wolf_rbac_access_check()
         ngx.say(json_encode({ok=true,
                             data={ userInfo={nickname="administrator",
                                 username="admin", id="100"} }}))
+    elseif resName == '/hello/no_userinfo' then
+        -- authorized (200) but the backend returns no userInfo
+        ngx.say(json_encode({ok=true, data={}}))
     elseif resName == '/hello/500' then
         ngx.status = 500
         ngx.say(json_encode({ok=false, reason="ERR_SERVER_ERROR"}))

t/plugin/wolf-rbac.t

@@ -890,3 +890,74 @@ X-Real-IP: 192.0.2.10
 wolf_rbac_access_check clientIP: 127.0.0.1
 --- no_error_log
 wolf_rbac_access_check clientIP: 192.0.2.10
+
+
+
+=== TEST 43: consumer and route that echo upstream-bound request headers
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/consumers',
+                ngx.HTTP_PUT,
+                [[{
+                    "username": "wolf_rbac_no_echo",
+                    "plugins": {
+                        "wolf-rbac": {
+                            "appid": "wolf-rbac-app-noecho",
+                            "server": "http://127.0.0.1:1982"
+                        }
+                    }
+                }]]
+                )
+            if code >= 300 then
+                ngx.status = code
+                ngx.say(body)
+                return
+            end
+
+            code, body = t('/apisix/admin/routes/2',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "wolf-rbac": {},
+                        "serverless-post-function": {
+                            "phase": "access",
+                            "functions": [
+                                "return function(conf, ctx) local core = require(\"apisix.core\"); core.response.exit(200, core.request.headers(ctx)); end"
+                            ]
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1982": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello/no_userinfo"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 44: client-supplied identity headers dropped when auth response omits userInfo
+--- request
+GET /hello/no_userinfo
+--- more_headers
+Authorization: V1#wolf-rbac-app-noecho#wolf-rbac-token
+X-UserId: spoofid007
+X-Username: spoofadmin
+--- error_code: 200
+--- response_body_like eval
+qr/(?s)^(?!.*spoofid007)(?!.*spoofadmin).*authorization/
+--- no_error_log
+[error]