feat: support hide credentials for jwt-auth plugin

apisix/plugins/jwt-auth.lua

@@ -48,6 +48,10 @@ local schema = {
         cookie = {
             type = "string",
             default = "jwt"
+        },
+        hide_credentials = {
+            type = "boolean",
+            default = false
         }
     },
 }
@@ -188,10 +192,33 @@ function _M.check_schema(conf, schema_type)
     return true
 end
 
+local function remove_specified_cookie(src, key)
+    local ret = ""
+    local append = false
+    local cookie_key_pattern = "([a-zA-Z0-9-_]*)"
+    local cookie_val_pattern = "([a-zA-Z0-9-._]*)"
+
+    for k, v in string.gmatch(src, cookie_key_pattern .. "=" .. cookie_val_pattern) do
+        if k ~= key then
+            if append then
+                ret = ret .. "; "
+            end
+            ret = ret .. k .. "=" .. v
+            append = true
+        end
+    end
+
+    return ret
+end
 
 local function fetch_jwt_token(conf, ctx)
     local token = core.request.header(ctx, conf.header)
     if token then
+        if conf.hide_credentials then
+            -- hide for header
+            core.request.set_header(ctx, conf.header, nil)
+        end
+
         local prefix = sub_str(token, 1, 7)
         if prefix == 'Bearer ' or prefix == 'bearer ' then
             return sub_str(token, 8)
@@ -200,15 +227,29 @@ local function fetch_jwt_token(conf, ctx)
         return token
     end
 
-    token = ctx.var["arg_" .. conf.query]
+    local uri_args = core.request.get_uri_args(ctx) or {}
+    token = uri_args[conf.query]
     if token then
+        if conf.hide_credentials then
+            -- hide for query
+            uri_args[conf.query] = nil
+            core.request.set_uri_args(ctx, uri_args)
+        end
         return token
     end
 
     local val = ctx.var["cookie_" .. conf.cookie]
     if not val then
         return nil, "JWT not found in cookie"
     end
+
+    if conf.hide_credentials then
+        -- hide for cookie
+        local src = core.request.header(ctx, "Cookie")
+        local reset_val = remove_specified_cookie(src, conf.cookie)
+        core.request.set_header(ctx, "Cookie", reset_val)
+    end
+
     return val
 end
 
@@ -357,8 +398,8 @@ local function algorithm_handler(consumer, method_only)
     end
 end
 
-
 function _M.rewrite(conf, ctx)
+    -- fetch token and hide credentials if necessary
     local jwt_token, err = fetch_jwt_token(conf, ctx)
     if not jwt_token then
         core.log.info("failed to fetch JWT token: ", err)

docs/en/latest/plugins/basic-auth.md

@@ -46,7 +46,7 @@ For Route:
 
 | Name             | Type    | Required | Default | Description                                                            |
 |------------------|---------|----------|---------|------------------------------------------------------------------------|
-| hide_credentials | boolean | False    | false   | Set to true to pass the authorization request headers to the Upstream. |
+| hide_credentials | boolean | False    | false   | Set to true will not pass the authorization request headers to the Upstream. |
 
 ## Enabling the Plugin
 

docs/en/latest/plugins/jwt-auth.md

@@ -66,6 +66,7 @@ For Route:
 | header | string | False    | authorization | The header to get the token from.                                   |
 | query  | string | False    | jwt           | The query string to get the token from. Lower priority than header. |
 | cookie | string | False    | jwt           | The cookie to get the token from. Lower priority than query.        |
+| hide_credentials | boolean | False     | false  | Set to true will not pass the authorization request of header\query\cookie to the Upstream.|
 
 ## API
 

docs/zh/latest/plugins/basic-auth.md

@@ -46,7 +46,7 @@ Route 端：
 
 | 名称             | 类型     | 必选项 | 默认值  | 描述                                                            |
 | ---------------- | ------- | ------ | ------ | --------------------------------------------------------------- |
-| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则会将 Authorization 请求头传递给 Upstream。|
+| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则不会将 Authorization 请求头传递给 Upstream。|
 
 ## 启用插件
 

docs/zh/latest/plugins/jwt-auth.md

@@ -66,6 +66,7 @@ Route 端：
 | header | string | 否     | authorization | 设置我们从哪个 header 获取 token。                         |
 | query  | string | 否     | jwt           | 设置我们从哪个 query string 获取 token，优先级低于 header。  |
 | cookie | string | 否     | jwt           | 设置我们从哪个 cookie 获取 token，优先级低于 query。        |
+| hide_credentials | boolean | 否     | false  | 该参数设置为 `true` 时，则不会将含有认证信息的 header\query\cookie string 传递给 Upstream。|
 
 ## 接口