fix(jwe-decrypt): skip decrypt when token is missing and strict is false

apisix/plugins/jwe-decrypt.lua

@@ -175,9 +175,14 @@ end
 function _M.rewrite(conf, ctx)
     -- fetch token and hide credentials if necessary
     local jwe_token, err = fetch_jwe_token(conf, ctx)
-    if not jwe_token and conf.strict then
-        core.log.info("failed to fetch JWE token: ", err)
-        return 403, { message = "missing JWE token in request" }
+    if not jwe_token then
+        -- If true, throw a 403 error if JWE token is missing from the request.
+        -- If false, do not throw an error when JWE token is not found.
+        if conf.strict then
+            core.log.info("failed to fetch JWE token: ", err)
+            return 403, { message = "missing JWE token in request" }
+        end
+        return
     end
 
     local jwe_obj = load_jwe_token(jwe_token)

t/plugin/jwe-decrypt.t

@@ -577,3 +577,50 @@ done
     }
 --- response_body
 status: 400
+
+
+
+=== TEST 24: enable jwe-decrypt with strict=false
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/11',
+                ngx.HTTP_PUT,
+                [[{
+                    "plugins": {
+                        "jwe-decrypt": {
+                            "header": "Authorization",
+                            "forward_header": "Authorization",
+                            "strict": false
+                        },
+                        "proxy-rewrite": {
+                            "uri": "/hello"
+                        }
+                    },
+                    "upstream": {
+                        "nodes": {
+                            "127.0.0.1:1980": 1
+                        },
+                        "type": "roundrobin"
+                    },
+                    "uri": "/hello-nonstrict"
+                }]]
+                )
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 25: missing token with strict=false is allowed
+--- request
+GET /hello-nonstrict
+--- response_body
+hello world