apisix-dashboard icon indicating copy to clipboard operation
apisix-dashboard copied to clipboard

request help: ensure explicitly sets the secret field when using jwt-auth on consumer

Open bzp2010 opened this issue 2 years ago • 1 comments

Feature request

Please describe your feature

The current jwt-auth plugin configuration in APISIX has special logic. If a user uses HS mode but does not set a secret, APISIX will generate one and write it to etcd, but the dashboard does not have the corresponding logic.

Describe the solution you'd like

Before we switch to using the Admin API directly, we need some means to circumvent this problem, and I think we can add a form UI to it that helps users avoid this problem by forcing input requirements and automatically generating random characters.

Describe alternatives you've considered

The above solution is a frontend solution, we can also extend the logic in the backend to merge a copy of the patched jsonschema into the actual version to ensure we can enforce the secret presence check. (We can't directly modifying the jsonschema data exported through the APISIX Control API)

Additional context

https://github.com/apache/apisix/issues/6564 https://github.com/apache/apisix-dashboard/issues/2383 https://github.com/apache/apisix-dashboard/issues/2176#issuecomment-944127485

bzp2010 avatar Mar 17 '22 01:03 bzp2010

I want to solve this issue I want to check the values of the secret and algorithm fields when processing data at the back end. If the secret field is empty, 32-bit characters will be randomly generated, and then base64 will be encrypted. If the algorithm field is empty, the default value HS256 will be given.

kingmouse-yx avatar Mar 17 '22 02:03 kingmouse-yx