bug: allow_origins_by_metadata does not work without allow_origins about apisix HOT 4 CLOSED

OK, I have reproduced the problem and I will propose a fix later.

from apisix.

Good capture! 👍

from apisix.

@monkeyDluffy6017
Firstly, I find it odd that if a user sets allow_origins_by_metadata, then each router with allow_origins_by_metadata but without setting allow_origins would pass through all origins. Users typically use allow_origins_by_metadata to avoid configuring allow_origins for each router, yet they still need to set allow_origins for each router.

Secondly, it's also peculiar that the router registered by the user with allow_origins_by_metadata would only take effect after setting allow_origins for the router.

My understanding of allow_origins_by_metadata is that it's a publicly available list used to restrict origins.

from apisix.

OK, i got you

from apisix.