Struct HmacAuthPlugin 

pub struct HmacAuthPlugin {
    access_key: Option<String>,
    secret_key: Option<String>,
    algorithm: HmacAlgorithm,
    clock_skew: u64,
    signed_headers: Vec<String>,
    use_consumers: bool,
    anonymous_consumer: Option<String>,
    keep_headers: bool,
    hide_credentials: bool,
    realm: String,
    resources: Arc<PluginResources>,
}

Authenticates requests by verifying an HMAC signature over a canonical signing string.

With inline access_key/secret_key a single credential is accepted. With use_consumers: true the presented access_key is resolved against the gateway’s consumers: section (their hmac-auth: {access_key, secret_key} credentials) and, on a valid signature, the consumer’s identity is attached to the request. Both may be enabled together — the inline key is checked first.

Fields

access_key: Option<String>

Inline credential access key (the keyId), if configured.

secret_key: Option<String>

Inline secret paired with access_key.

algorithm: HmacAlgorithm

The single algorithm this node accepts.

clock_skew: u64

Maximum allowed difference between the Date header and now, in seconds; 0 disables the check.

signed_headers: Vec<String>

Header names the client MUST have included in its signature.

use_consumers: bool

When true, keys are also resolved against the consumer store.

anonymous_consumer: Option<String>

Consumer attached when no credential matches (instead of rejecting).

keep_headers: bool

When false (default), the X-HMAC-* proof headers are stripped before proxying upstream.

hide_credentials: bool

When true, the Authorization header is stripped before proxying.

realm: String

Realm advertised in the WWW-Authenticate challenge.

resources: Arc<PluginResources>

Implementations

impl HmacAuthPlugin

pub fn from_config( config: &HashMap<String, Value>, resources: &Arc<PluginResources>, ) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• use_consumers (bool, default false): resolve the access_key against the gateway’s consumers: section and attach the consumer.
• access_key (string, optional): inline single-credential key id.
• secret_key (string, required when access_key is set): the paired secret.
• At least one of access_key / use_consumers must be provided.
• algorithm (string, default "hmac-sha256"): one of hmac-sha1, hmac-sha256, hmac-sha512.
• clock_skew (integer seconds, default 300): max Date drift; 0 disables the check.
• signed_headers (array of strings, optional): headers the client must have signed; a request omitting any is rejected.
• keep_headers (bool, default false): keep the X-HMAC-* proof headers when proxying (they are stripped by default).
• hide_credentials (bool, default false): strip the Authorization header before proxying.
• anonymous_consumer (string, optional): consumer attached when no credential matches, instead of rejecting.
• realm (string, default "hmac"): WWW-Authenticate realm.

type: hmac-auth
config:
  use_consumers: true
  algorithm: hmac-sha256
  clock_skew: 300
  signed_headers: [date]

fn reject( &self, ctx: Context, msg: &str, ) -> Result<PluginOutput, PluginExecutionError>

Builds the 401 rejection routed through the error port with code HMAC_INVALID.

fn header<'a>(ctx: &'a Context, name: &str) -> Option<&'a str>

Reads a single-valued request header (lowercased key).

fn retrieve_params(ctx: &Context) -> Option<HmacParams>

Extracts the signature parameters from the Authorization: Signature header or, failing that, the X-HMAC-* headers.

fn parse_authorization(rest: &str) -> Option<HmacParams>

Parses the comma-separated keyId="..",algorithm="..",headers="..",signature=".." field list (the part after Signature ).

fn request_uri(ctx: &Context) -> String

Reconstructs the request URI (path plus a sorted query string) used for the @request-target pseudo-header.

fn signing_string(&self, ctx: &Context, params: &HmacParams) -> String

Builds the canonical signing string from the presented signed headers.

fn verify_signature( &self, ctx: &Context, params: &HmacParams, secret: &str, ) -> bool

Verifies the client signature against the recomputed one.

fn validate_common( &self, ctx: &Context, params: &HmacParams, ) -> Result<(), String>

Enforces the algorithm, clock skew, and required signed headers common to both credential sources. Returns Err(reason) on any violation.

fn strip_headers(&self, ctx: &mut Context)

Strips the proof/credential headers per keep_headers/hide_credentials.

impl HmacAuthPlugin

fn attach_anonymous( &self, ctx: Context, ) -> Result<PluginOutput, PluginExecutionError>

Attaches the configured anonymous consumer, or rejects if it is unknown.

Trait Implementations

impl Plugin for HmacAuthPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.