HMAC Auth Changelog
Released changes to the HMAC Auth plugin (`hmac-auth`), newest release first.
15 released changes name hmac-auth, newest release first — 7 in Apache APISIX, 8 in API7 Gateway. Each row links to the change itself.
| Release | Date | Type | Change |
|---|
| 3.10.6 (opens in API7 Gateway docs) | 2026-08-25 | Fix | Fixed issue: With hide_credentials enabled, the Authorization header was removed from the request sent upstream but stayed in the cached request headers, so a plugin ordered after HMAC Auth on the same route could sti… (opens in API7 Gateway docs) |
| 3.10.2 (opens in API7 Gateway docs) | 2026-06-29 | Fix | Fixed issue: When validate_request_body was enabled and a request body exceeded max_req_body_size, the request was rejected with a misleading HTTP 401. It is now rejected with HTTP 413. The default max_req_body_size w… (opens in API7 Gateway docs) |
| 3.10.1 (opens in API7 Gateway docs) | 2026-06-15 | Change | hmac-auth: when validate_request_body is enabled, the body is limited by a new max_req_body_size option (default 524288 bytes, i.e. 512 KiB). (opens in API7 Gateway docs) |
| 3.9.19 (opens in API7 Gateway docs) | 2026-08-26 | Fix | Fixed issue: With hide_credentials enabled, the Authorization header was removed from the request sent upstream but stayed in the cached request headers, so a plugin ordered after HMAC Auth on the same route could sti… (opens in API7 Gateway docs) |
| 3.9.15 (opens in API7 Gateway docs) | 2026-06-22 | Fix | Fixed issue: With validate_request_body enabled, the request body the plugin buffers to verify the signature was limited to 512 KiB by default, rejecting larger bodies that the upstream would accept, and an over-limit… (opens in API7 Gateway docs) |
| 3.9.5 (opens in API7 Gateway docs) | 2026-02-14 | Fix | Fixed issue: When plugins with encrypt_fields had schema fields with maxLength constraints (e.g., hmac-auth secret_key max 32 chars), the encrypted ciphertext exceeded the length limit because schema validation ran be… (opens in API7 Gateway docs) |
| 3.9.2 (opens in API7 Gateway docs) | 2026-01-19 | Feature | Basic Auth/JWT Auth/Key Auth/HMAC Auth/LDAP Auth: Added a realm configuration option to set the Realm value in the WWW-Authenticate response header for 401 authentication failures. (opens in API7 Gateway docs) |
| 3.2.16.3 (opens in API7 Gateway docs) | 2024-10-21 | Feature | HMAC Authentication (opens in API7 Gateway docs) |
