Add parameter block-when-referrer-not-parsable to plugin referer-restriction
- Dominant language
- Lua
- Stars
- 17.1k
- Forks
- 2.9k
- Avg merge
- 3d 16h
- Merged PRs (30d)
- 63
Description
### Description
I want to block request with an invalid referer-header.
At the moment not parsable referrers are treated like empty referrer values.
see
https://github.com/apache/apisix/blame/dca582e3bd49665531509c51880dcb6a131601df/apisix/plugins/referer-restriction.lua#L114
I want to configure that empty referrers are ok (with an additional black- or white-list), but malformed / malicious referrers-strings are blocked
Contributor guide
Research direction
Start with the referer parsing logic at the linked location in apisix/plugins/referer-restriction.lua, and trace how unparsable and empty referrers are currently handled. Define the configurable behavior so empty referrers can remain permitted while malformed referrers are blocked, then verify both cases with the plugin's existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua
- Domain
- api, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100