ACL

Release date 2026/07/07

Bugfix

• Fixed an issue where the ACL plugin returned a 403 error for authenticated credentials with no consumer and no groups (e.g. ACE / Dev Portal application credentials) when configured with a deny list. A group-less identity cannot match a deny list and should be allowed through.

• Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.

Release date 2026/07/02

Bugfix

• Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with a 403 error when include_consumer_groups was enabled and no Enterprise consumer groups were assigned.

Release date 2026/07/02

Bugfix

• Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.

Release date 2026/04/28

Bugfix

• Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with 403 when include_consumer_groups was enabled and no enterprise consumer groups were assigned.

Release date 2026/04/07

Feature

• Added WebSocket protocol support (ws/wss). The plugin now enforces allow/deny group rules during the WebSocket handshake phase.

Bugfix

• Fixed an issue where the ACL plugin did not check consumer groups from all sources, causing it to incorrectly deny access when consumer groups were set by other plugins like ACE in ngx.ctx.authenticated_consumer_groups.

Release date 2026/04/08

Bugfix

• Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with 403 when include_consumer_groups was enabled and no enterprise consumer groups were assigned.

Release date 2026/02/01

Bugfix

• Fixed an issue where the ACL plugin did not check consumer groups from all sources, causing it to incorrectly deny access when consumer groups were set by other plugins like ACE in ngx.ctx.authenticated_consumer_groups.

Release date 2025/12/18

Bugfix

• Fixed an issue where the cache was not being invalidated for incremental sync in certain scenarios, leading to stale data being served.

Release date 2025/11/18

Bugfix

• Fixed an issue where the cache was not being invalidated for incremental sync in certain scenarios, leading to stale data being served.

Release date 2025/10/23

Bugfix

• Fixed an issue where the cache was not being invalidated for incremental sync in certain scenarios, leading to stale data being served.

Release date 2025/12/09

Bugfix

• Fixed an issue where the cache was not being invalidated for incremental sync in certain scenarios, leading to stale data being served.

Release date 2024/09/11

Feature

• Added a new config always_use_authenticated_groups to support using authenticated groups even when an authenticated consumer already exists.

Release date 2024/02/12

Feature

• Add support for consumer-groups

Release date 2022/09/09

Breaking Change

• Removed the deprecated blacklist and whitelist configuration parameters. #8560