feat: support hide the authentication header in basic-auth with a config

apisix/plugins/basic-auth.lua

@@ -30,7 +30,12 @@ local consumers_lrucache = core.lrucache.new({
 local schema = {
     type = "object",
     title = "work with route or service object",
-    properties = {},
+    properties = {
+        hide_auth_header = {
+            type = "boolean",
+            default = true,
+        }
+    },
 }
 
 local consumer_schema = {
@@ -39,6 +44,10 @@ local consumer_schema = {
     properties = {
         username = { type = "string" },
         password = { type = "string" },
+        hide_auth_header = {
+            type = "boolean",
+            default = true,
+        }
     },
     required = {"username", "password"},
 }
@@ -161,6 +170,11 @@ function _M.rewrite(conf, ctx)
         return 401, { message = "Password is error" }
     end
 
+    -- 5. hide `Authentication` request header if `hide_auth_header` is `true`
+    if conf.hide_auth_header == true then
+        core.request.set_header(ctx, "Authentication", "")
+    end
+
     consumer.attach_consumer(ctx, cur_consumer, consumer_conf)
 
     core.log.info("hit basic-auth access")

docs/en/latest/plugins/basic-auth.md

@@ -39,10 +39,11 @@ For more information on Basic authentication, refer to [Wiki](https://en.wikiped
 
 ## Attributes
 
-| Name     | Type   | Requirement | Default | Valid | Description                                                                                                                                                      |
-| -------- | ------ | ----------- | ------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| username | string | required    |         |       | Different `consumer` should have different value which is unique. When different `consumer` use a same `username`, a request matching exception would be raised. |
-| password | string | required    |         |       | the user's password                                                                                                                                              |
+| Name             | Type    | Requirement | Default | Valid | Description                                                                                                                                                      |
+| --------         | ------  | ----------- | ------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| username         | string  | required    |         |       | Different `consumer` should have different value which is unique. When different `consumer` use a same `username`, a request matching exception would be raised. |
+| password         | string  | required    |         |       | the user's password                                                                                                                                              |
+| hide_auth_header | boolean | optional    | true    |       | Whether to return the Authentication request headers to the client.                                                                                             |
 
 ## How To Enable
 
@@ -129,8 +130,8 @@ hello, world
 ## Disable Plugin
 
 When you want to disable the `basic-auth` plugin, it is very simple,
- you can delete the corresponding json configuration in the plugin configuration,
-  no need to restart the service, it will take effect immediately:
+you can delete the corresponding json configuration in the plugin configuration,
+no need to restart the service, it will take effect immediately:
 
 ```shell
 $ curl http://127.0.0.1:9080/apisix/admin/routes/1 -X PUT -d '

docs/zh/latest/plugins/basic-auth.md

@@ -43,6 +43,7 @@ title: basic-auth
 | -------- | ------ | ------ | ------ | ------ | ------------------------------------------------------------------------------------------------------------------ |
 | username | string | 必须   |        |        | 不同的 `consumer` 对象应有不同的值，它应当是唯一的。不同 consumer 使用了相同的 `username` ，将会出现请求匹配异常。 |
 | password | string | 必须   |        |        | 用户的密码                                                                                                         |
+| hide_auth_header | boolean | 可选    | true   |       | 是否将 Authentication 请求头返回给客户端.                                                                                             |
 
 ## 如何启用