jwe-decrypt
jwe-decrypt 插件解密发送到 APISIX 路由或服务的请求中的 JWE 授权头。
示例
以下示例演示了如何在不同场景下使用 jwe-decrypt 插件。
使用 JWE 解密数据
以下示例演示如何解密 JWE Token。在 APISIX 外部生成 JWE Token，在消费者上配置匹配的解密密钥，并创建启用 jwe-decrypt 插件的路由来解密 Authorization 请求头。
- Admin API
- ADC
- Ingress Controller
创建一个启用 jwe-decrypt 的 Consumer 并配置解密密钥：
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username": "jack",
"plugins": {
"jwe-decrypt": {
"key": "jack-key",
"secret": "key-length-should-be-32-chars123"
}
}
}'
创建一个启用 jwe-decrypt 的路由以解密 Authorization 头：
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "jwe-decrypt-route",
"uri": "/anything/jwe",
"plugins": {
"jwe-decrypt": {
"header": "Authorization",
"forward_header": "Authorization"
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
adc.yaml
consumers:
- username: jack
plugins:
jwe-decrypt:
key: jack-key
secret: key-length-should-be-32-chars123
services:
- name: jwe-decrypt-service
routes:
- name: jwe-decrypt-route
uris:
- /anything/jwe
plugins:
jwe-decrypt:
header: Authorization
forward_header: Authorization
upstream:
type: roundrobin
nodes:
- host: httpbin.org
port: 80
weight: 1
将配置同步到网关：
adc sync -f adc.yaml
- Gateway API
- APISIX CRD
jwe-decrypt-ic.yaml
apiVersion: v1
kind: Service
metadata:
namespace: aic
name: httpbin-external-domain
spec:
type: ExternalName
externalName: httpbin.org
---
apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
namespace: aic
name: jack
spec:
gatewayRef:
name: apisix
plugins:
- name: jwe-decrypt
config:
key: jack-key
secret: key-length-should-be-32-chars123
---
apiVersion: apisix.apache.org/v1alpha1
kind: PluginConfig
metadata:
namespace: aic
name: jwe-decrypt-plugin-config
spec:
plugins:
- name: jwe-decrypt
config:
header: Authorization
forward_header: Authorization
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
namespace: aic
name: jwe-decrypt-route
spec:
parentRefs:
- name: apisix
rules:
- matches:
- path:
type: Exact
value: /anything/jwe
filters:
- type: ExtensionRef
extensionRef:
group: apisix.apache.org
kind: PluginConfig
name: jwe-decrypt-plugin-config
backendRefs:
- name: httpbin-external-domain
port: 80
将配置应用到集群：
kubectl apply -f jwe-decrypt-ic.yaml
jwe-decrypt-apisix-crd.yaml
apiVersion: apisix.apache.org/v2
kind: ApisixUpstream
metadata:
namespace: aic
name: httpbin-external-domain
spec:
ingressClassName: apisix
externalNodes:
- type: Domain
name: httpbin.org
---
apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
namespace: aic
name: jack
spec:
ingressClassName: apisix
plugins:
- name: jwe-decrypt
config:
key: jack-key
secret: key-length-should-be-32-chars123
---
apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
namespace: aic
name: jwe-decrypt-route
spec:
ingressClassName: apisix
http:
- name: jwe-decrypt-route
match:
paths:
- /anything/jwe
upstreams:
- name: httpbin-external-domain
plugins:
- name: jwe-decrypt
config:
header: Authorization
forward_header: Authorization
将配置应用到集群：
kubectl apply -f jwe-decrypt-apisix-crd.yaml
在 APISIX 外部使用消费者 Secret 作为加密密钥生成 JWE Token。Token 应采用以下结构：
base64url(header)..base64url(iv).base64url(ciphertext).base64url(tag)
其中，请求头为 {"alg":"dir","enc":"A256GCM","kid":"<consumer-key>"}。请为每个 Token 使用唯一且随机生成的 IV。
APISIX 使用 AES-256-GCM 直接解密密文和认证标签，不会将受保护请求头作为附加认证数据（AAD）传入。如果使用通用 JWE 库生成 Token，请将其配置为不使用 AAD 计算认证标签；否则 APISIX 会拒绝 Token，并报告 failed to decrypt JWE token。
在 Authorization 请求头中携带 JWE 加密数据向路由发送请求。例如，以下 Token 使用上面配置的 Secret 和消费者密钥 jack-key，对 Payload {"uid":10000,"uname":"test"} 进行加密：
curl "http://127.0.0.1:9080/anything/jwe" -H 'Authorization: eyJraWQiOiJqYWNrLWtleSIsImFsZyI6ImRpciIsImVuYyI6IkEyNTZHQ00ifQ..vi29KBCQKcVmPwTT.VToyPMFbq-ZY05MIpntP1N3AmYeq3zELQ0B6iQ.vuTPG2ODc-DjUTjNCzfA2A'
你应该看到类似于以下的响应，其中 Authorization 头显示了 Payload 的明文：
{
"args": {},
"data": "",
"files": {},
"form": {},
"headers": {
"Accept": "*/*",
"Authorization": "{\"uid\":10000,\"uname\":\"test\"}",
"Host": "127.0.0.1",
"User-Agent": "curl/8.1.2",
"X-Amzn-Trace-Id": "Root=1-6510f2c3-1586ec011a22b5094dbe1896",
"X-Forwarded-Host": "127.0.0.1"
},
"json": null,
"method": "GET",
"origin": "127.0.0.1, 119.143.79.94",
"url": "http://127.0.0.1/anything/jwe"
}