江宁城乡建设局网站给网站做图

在 API 网关中，身份认证 是保障接口安全的重要手段之一。Kong 作为主流 API 网关之一，提供了多种认证方式，其中 API Key Authentication 适用于 轻量级认证 场景。本文将详细介绍如何在 Kong 中启用 API Key 认证 并进行测试。

1.1.1、环境准备

1.1.1.1、创建一个服务，key-auth-demo

curl -i -s -X POST http://localhost:8001/services \--data name=key-auth-demo \--data url='http://localhost:8080'

http://localhost:8080 端口是运行一个Go的服务，请求/hello将返回对应的数据。

将会返回数据：

Hello, kong,I'm runing at 8080!

1.1.1.2、创建对应的路由，key-auth-demo

curl -i -X POST http://localhost:8001/services/key-auth-demo/routes \--data 'paths[]=/key-auth-demo' \--data name=key-auth-demo

1.1.1.3、测试环境

[root@iZbp1ivu3yaedumdy0va2vZ kong]# curl http://localhost:8000/key-auth-demo/hello
Hello, kong,I'm runing at 8080!

看到如下输出，证明已经环境已经搭建OK。

1.1.2、插件安装

插件的相关文档为

https://docs.konghq.com/hub/kong-inc/key-auth/configuration/

1.1.2.1、在服务范围内安装

curl -X POST http://localhost:8001/services/{serviceName|Id}/plugins \--header "accept: application/json" \--header "Content-Type: application/json" \--data '{"name": "key-auth","config": {"key_names": ["apikey"]}
}示例：
curl -X POST http://localhost:8001/services/key-auth-demo/plugins \--header "accept: application/json" \--header "Content-Type: application/json" \--data '{"name": "key-auth","config": {"key_names": ["apikey"]}
}'

{serviceName|Id} : 这里用要对哪个服务开启

name: 代表已启动的插件名

config： 插件对应的配置信息

返回的结果如下：

{"consumer": null,"config": {"hide_credentials": false,"key_in_header": true,"key_in_query": true,"key_in_body": false,"run_on_preflight": true,"key_names": ["apikey"],"realm": null,"anonymous": null},"name": "key-auth","instance_name": null,"protocols": ["grpc","grpcs","http","https"],"created_at": 1739512641,"updated_at": 1739512641,"enabled": true,"service": {"id": "ae557210-8f1f-415b-8549-3c973e495881"},"id": "8b8d48db-3a15-4a94-ba81-93a1f350702d","route": null,"tags": null
}

1.1.2.2、 在route范围内安装

curl -X POST http://localhost:8001/routes/{route_id_or_name}/plugins \--header "accept: application/json" \--header "Content-Type: application/json" \--data '{"name": "key-auth","config": {"key_names": ["apikey"]}
}'
实例
curl -X POST http://localhost:8001/routes/key-auth-demo/plugins \--header "accept: application/json" \--header "Content-Type: application/json" \--data '{"name": "key-auth","config": {"key_names": ["apikey"]}
}'

1.1.2.3、 全局范围内安装

curl -X POST http://localhost:8001/plugins \--header "accept: application/json" \--header "Content-Type: application/json" \--data '{"name":"key-auth","enabled":true,"protocols":["grpc","grpcs","http","https"],"config":{"hide_credentials":false,"key_in_body":false,"key_in_header":true,"key_in_query":true,"key_names":["apikey"],"run_on_preflight":true}}'

1.1.2、测试

开启了kye-auth插件后，如果还是正常访问，将会返回401

[root@iZbp1ivu3yaedumdy0va2vZ ~]# curl -i  http://localhost:8000/key-auth-demo/hello
HTTP/1.1 401 Unauthorized
Date: Fri, 14 Feb 2025 06:04:46 GMT
Content-Type: application/json; charset=utf-8
Connection: keep-alive
WWW-Authenticate: Key
Content-Length: 96
X-Kong-Response-Latency: 1
Server: kong/3.9.0
X-Kong-Request-Id: 3d24b81b896b1b3e6bcc626177e8ea3b{"message":"No API key found in request","request_id":"3d24b81b896b1b3e6bcc626177e8ea3b"
}

那么应该如何访问呢？

• 创建一个用户

  curl -X POST http://localhost:8001/consumers -d username=key-auth-user
  

• 给这个用户分配一个apiKey

  curl -X POST http://localhost:8001/consumers/key-auth-user/key-auth \-d key=api_key_78954455
  

在请求头中携带apikey,或者在请求参数中携带apikey,如下所示：

[root@iZbp1ivu3yaedumdy0va2vZ ~]# curl -i -H "apikey:api_key_78954455" http://localhost:8000/key-auth-demo/hello
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 31
Connection: keep-alive
Date: Fri, 14 Feb 2025 06:10:22 GMT
Server: kong/3.9.0
X-Kong-Upstream-Latency: 0
X-Kong-Proxy-Latency: 3
Via: 1.1 kong/3.9.0
X-Kong-Request-Id: e9e4eb0de1646867fcb3b810ef8d9570Hello, kong,I'm runing at 8080!curl -i  http://localhost:8000/key-auth-demo/hello?apikey=api_key_78954455

[root@iZbp1ivu3yaedumdy0va2vZ ~]# curl -i  http://localhost:8000/key-auth-demo/hello?apikey=api_key_78954455
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 31
Connection: keep-alive
Date: Fri, 14 Feb 2025 06:13:40 GMT
Server: kong/3.9.0
X-Kong-Upstream-Latency: 1
X-Kong-Proxy-Latency: 1
Via: 1.1 kong/3.9.0
X-Kong-Request-Id: cbfd604c2e274833e2baa77dfe322938Hello, kong,I'm runing at 8080!

1.1.3、环境清理

1.1.3.1、清除服务范围内的插件

• 获取服务范围内的插件

curl -X GET http://localhost:8001/services/key-auth-demo/plugins{"data": [{// ..."id": "8b8d48db-3a15-4a94-ba81-93a1f350702d",// ...}],"next": null
}

这里我我记录想要删除id是啥，到下一步请求的时候需要使用。

• 删除指定的插件

  curl -X DELETE http://localhost:8001/services/key-auth-demo/plugins/8b8d48db-3a15-4a94-ba81-93a1f350702d
  

  身份认证插件清除后，不适用apiKey也能进行访问了。

1.1.3.2、清除route范围内的插件

• 获取route范围内的插件

  curl -X GET http://localhost:8001/routes/key-auth-demo/plugins{"data": [{// ..."id": "22245c50-f2d1-42c8-b4aa-090414e763d3",// ...}],"next": null
  }
  

• 删除指定的插件

  curl -X DELETE http://localhost:8001/routes/key-auth-demo/plugins/22245c50-f2d1-42c8-b4aa-090414e763d3
  

1.1.3.2、清除全局范围内的插件

• 获取全局范围内的插件

curl -X GET http://localhost:8001/plugins
返回结果，省略部分数据
{"data": [{"id": "5ebe8f78-41b0-4ae6-a21c-4e69f97d419c",}],"next": null
}

• 删除指定的插件

curl -X DELETE http://localhost:8001/plugins/5ebe8f78-41b0-4ae6-a21c-4e69f97d419c

1.1.4、总结

基于 API Key Authentication 的插件非常适合需要快速、轻量认证的场景，尤其在以下情况下表现尤为出色：

• 提供开放 API 给开发者或第三方系统。
• 简单的客户端认证，尤其在移动应用和 Web 应用中。
• 管理和限制不同用户、客户端或服务的访问权限。
• 配合流量控制插件（如 Rate Limiting）使用，避免过度请求。

虽然 API 密钥认证简单易用，但它的安全性相对较低，尤其是在传输过程中密钥可能会被泄露。

因此，常常配合 HTTPS 使用，以保证通信的安全。