JWT Auth Changelog
Released changes to the JWT Auth plugin (`jwt-auth`), newest release first.
26 released changes name jwt-auth, newest release first — 11 in Apache APISIX, 15 in API7 Gateway. Each row links to the change itself.
| Release | Date | Type | Change |
|---|
| 3.10.6 (opens in API7 Gateway docs) | 2026-08-25 | Fix | Fixed issue: A jwt-auth consumer credential using an asymmetric algorithm was written to the configuration store with a placeholder private_key field the user never configured, which the Data Plane reported as an unre… (opens in API7 Gateway docs) |
| 3.10.1 (opens in API7 Gateway docs) | 2026-06-15 | Fix | Fixed issue: A token whose signature was malformed (wrong length or not valid base64url) caused the verifier to raise an error and return HTTP 500 instead of rejecting the request. Malformed signatures are now rejecte… (opens in API7 Gateway docs) |
| 3.9.19 (opens in API7 Gateway docs) | 2026-08-26 | Fix | Fixed issue: A jwt-auth consumer credential using an asymmetric algorithm was written to the configuration store with a placeholder private_key field the user never configured, which the Data Plane reported as an unre… (opens in API7 Gateway docs) |
| 3.9.15 (opens in API7 Gateway docs) | 2026-06-22 | Fix | Fixed issue: A token whose signature was malformed (wrong length or not valid base64url) caused the verifier to raise an error and return HTTP 500 instead of rejecting the request. Malformed signatures are now rejecte… (opens in API7 Gateway docs) |
| 3.9.11 (opens in API7 Gateway docs) | 2026-04-30 | Feature | All plugins now support $secret:// and $env:// references in any configuration field automatically. Previously, only a handful of plugins (jwt-auth, openid-connect, limit-count, authz-keycloak, csrf, limit-req, limit-… (opens in API7 Gateway docs) |
| 3.9.9 (opens in API7 Gateway docs) | 2026-04-10 | Fix | Fixed issue: The Data Plane compatibility report showed spurious warnings for valid plugin configurations. Plugins using patternProperties, conditional schemas (if/then/else), allOf, dependencies, or additionalPropert… (opens in API7 Gateway docs) |
| 3.9.9 (opens in API7 Gateway docs) | 2026-04-10 | Fix | Fixed issue: The JWT Auth plugin did not verify that the JWT token's alg header matched the consumer's configured algorithm before signature verification, which could allow algorithm confusion attacks. (opens in API7 Gateway docs) |
| 3.9.2 (opens in API7 Gateway docs) | 2026-01-19 | Feature | Basic Auth/JWT Auth/Key Auth/HMAC Auth/LDAP Auth: Added a realm configuration option to set the Realm value in the WWW-Authenticate response header for 401 authentication failures. (opens in API7 Gateway docs) |
| 3.8.9 (opens in API7 Gateway docs) | 2025-08-11 | Feature | Added store_in_ctx parameter to store validated JWT object in request context. When set to true (default is false), the plugin stores the validated JWT object in the request context, useful for custom plugins that nee… (opens in API7 Gateway docs) |
| 3.8.9 (opens in API7 Gateway docs) | 2025-08-11 | Fix | Fixed issue: Plugin failed to validate exp claim when claims_to_verify: ["exp"] is set. (opens in API7 Gateway docs) |
| 3.8.5 (opens in API7 Gateway docs) | 2025-06-16 | Fix | Fixed issue: real_payload can be overridden by malicious payload in the jwt-auth plugin. (opens in API7 Gateway docs) |
| 3.2.16.6 (opens in API7 Gateway docs) | 2024-11-25 | Change | The JWT Auth plugin supported key_claim_name. (opens in API7 Gateway docs) |
| 3.2.16.4 (opens in API7 Gateway docs) | 2024-11-01 | Change | JWT Auth Plugin now supports more algorithm. (opens in API7 Gateway docs) |
| 3.2.16.3 (opens in API7 Gateway docs) | 2024-10-21 | Feature | JWT Authentication (opens in API7 Gateway docs) |
| 3.2.16.0 (opens in API7 Gateway docs) | 2024-09-30 | Change | 【Breaking Change】Removed the JWT plugin's functionality for issuing tokens, and removed the ability to upload private keys. See JWT Plugin for details. (opens in API7 Gateway docs) |
Docs