Basic Auth Changelog
Released changes to the Basic Auth plugin (`basic-auth`), newest release first.
17 released changes name basic-auth, newest release first — 5 in Apache APISIX, 12 in API7 Gateway. Each row links to the change itself.
| Release | Date | Type | Change |
|---|
| 3.10.7 (opens in API7 Gateway docs) | 2026-09-08 | Fix | Fixed issue: A consumer whose password contained a colon could never authenticate. RFC 7617 defines everything after the first colon as the password, but the credentials were split on every colon, which truncated it. (opens in API7 Gateway docs) |
| 3.10.7 (opens in API7 Gateway docs) | 2026-09-08 | Fix | Fixed issue: A consumer whose password was empty — stored as an empty string, or resolved from an $env:// or $secret:// reference that yielded one — authenticated any request presenting its username with an empty pass… (opens in API7 Gateway docs) |
| 3.10.7 (opens in API7 Gateway docs) | 2026-09-08 | Fix | Fixed issue: Pasting into the input fields of the interactive API documentation viewer, including the Basic Auth credential fields, did not work or mishandled line breaks, so a pasted credential could be dropped or ma… (opens in API7 Gateway docs) |
| 3.9.20 (opens in API7 Gateway docs) | 2026-09-03 | Fix | Fixed issue: A consumer whose password contained a colon could never authenticate. RFC 7617 defines everything after the first colon as the password, but the credentials were split on every colon, which truncated it. (opens in API7 Gateway docs) |
| 3.9.20 (opens in API7 Gateway docs) | 2026-09-03 | Fix | Fixed issue: A consumer whose password was empty — stored as an empty string, or resolved from an $env:// or $secret:// reference that yielded one — authenticated any request presenting its username with an empty pass… (opens in API7 Gateway docs) |
| 3.9.14 (opens in API7 Gateway docs) | 2026-06-15 | Feature | Credential secrets (such as key-auth and basic-auth keys) are now returned only once, at creation time. Subsequent reads of the credential omit the secret value. (opens in API7 Gateway docs) |
| 3.9.10 (opens in API7 Gateway docs) | 2026-04-22 | Feature | Added form-based configuration modes for the Key Auth and Basic Auth plugins, enabling visual credential setup without manual JSON editing. (opens in API7 Gateway docs) |
| 3.9.2 (opens in API7 Gateway docs) | 2026-01-19 | Feature | Basic Auth/JWT Auth/Key Auth/HMAC Auth/LDAP Auth: Added a realm configuration option to set the Realm value in the WWW-Authenticate response header for 401 authentication failures. (opens in API7 Gateway docs) |
| 3.8.11 (opens in API7 Gateway docs) | 2025-08-25 | Fix | Fixed issue: Made the scheme part ("Basic") case-insensitive. (opens in API7 Gateway docs) |
| 3.8.9 (opens in API7 Gateway docs) | 2025-08-11 | Fix | Fixed issue: Improved error messages when using consumer-restriction with basic-auth plugin. When type is set to consumer_group_id with blacklist configuration, non-blacklisted consumers now receive appropriate error… (opens in API7 Gateway docs) |
| 3.2.16.6 (opens in API7 Gateway docs) | 2024-11-25 | Fix | Removed extra warning log in the Basic Auth plugin. (opens in API7 Gateway docs) |
| 3.2.16.3 (opens in API7 Gateway docs) | 2024-10-21 | Feature | Basic Authentication (opens in API7 Gateway docs) |
