apache / apache/apisix

Add parameter block-when-referrer-not-parsable to plugin referer-restriction

Open
#13,110 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Description

I want to block request with an invalid referer-header.

At the moment not parsable referrers are treated like empty referrer values.
see

https://github.com/apache/apisix/blame/dca582e3bd49665531509c51880dcb6a131601df/apisix/plugins/referer-restriction.lua#L114

I want to configure that empty referrers are ok (with an additional black- or white-list), but malformed / malicious referrers-strings are blocked

Contributor guide

Open the contributing guide

Research direction

Start with the referer parsing logic at the linked location in apisix/plugins/referer-restriction.lua, and trace how unparsable and empty referrers are currently handled. Define the configurable behavior so empty referrers can remain permitted while malformed referrers are blocked, then verify both cases with the plugin's existing tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
api, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.