From dd56e6f5b479aeef122446662398d9cb5086c817 Mon Sep 17 00:00:00 2001
From: Arjen10 <thistime833@gmail.com>
Date: Thu, 13 Aug 2026 22:38:06 +0800
Subject: [PATCH] fix(jwe-decrypt): skip decrypt when token is missing and
 strict is false

---
 apisix/plugins/jwe-decrypt.lua | 11 +++++---
 t/plugin/jwe-decrypt.t         | 47 ++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/apisix/plugins/jwe-decrypt.lua b/apisix/plugins/jwe-decrypt.lua
index fbc9d3fff9d7..9c74aaf5df52 100644
--- a/apisix/plugins/jwe-decrypt.lua
+++ b/apisix/plugins/jwe-decrypt.lua
@@ -175,9 +175,14 @@ end
 function _M.rewrite(conf, ctx)
     -- fetch token and hide credentials if necessary
     local jwe_token, err = fetch_jwe_token(conf, ctx)
-    if not jwe_token and conf.strict then
-        core.log.info("failed to fetch JWE token: ", err)
-        return 403, { message = "missing JWE token in request" }
+    if not jwe_token then
+        -- If true, throw a 403 error if JWE token is missing from the request.
+        -- If false, do not throw an error when JWE token is not found.
+        if conf.strict then
+            core.log.info("failed to fetch JWE token: ", err)
+            return 403, { message = "missing JWE token in request" }
+        end
+        return
     end
 
     local jwe_obj = load_jwe_token(jwe_token)
diff --git a/t/plugin/jwe-decrypt.t b/t/plugin/jwe-decrypt.t
index d862015055ef..be346ea1d2f4 100644
--- a/t/plugin/jwe-decrypt.t
+++ b/t/plugin/jwe-decrypt.t
@@ -577,3 +577,50 @@ done
     }
 --- response_body
 status: 400
+
+
+
+=== TEST 24: enable jwe-decrypt with strict=false
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/11',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "jwe-decrypt": {
+                            "header": "Authorization",
+                            "forward_header": "Authorization",
+                            "strict": false
+                        },
+                        "proxy-rewrite": {
+                            "uri": "/hello"
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello-nonstrict"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 25: missing token with strict=false is allowed
+--- request
+GET /hello-nonstrict
+--- response_body
+hello world