ACL

Overview Examples Guides Configuration reference Changelog API reference

3.16.0.0

Release date 2026/09/15

Added allow_when/deny_when fields that evaluate CEL boolean expressions against the request context to provide more expressive access‑control policies.

Fixed an issue where the ACL plugin returned 403 for authenticated credentials with no consumer and no groups (e.g. ACE / Dev Portal application credentials) when configured with a deny list. A group-less identity cannot match a deny list and should be allowed through.
Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.

Release date 2026/07/07

Fixed an issue where the ACL plugin returned a 403 error for authenticated credentials with no consumer and no groups (e.g. ACE / Dev Portal application credentials) when configured with a deny list. A group-less identity cannot match a deny list and should be allowed through.
Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.

Release date 2026/07/02

Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with a 403 error when include_consumer_groups was enabled and no Enterprise consumer groups were assigned.

Release date 2026/07/14

Fixed an issue where the ACL plugin returned 403 for authenticated credentials with no consumer and no groups (e.g. ACE / Dev Portal application credentials) when configured with a deny list. A group-less identity cannot match a deny list and should be allowed through.

Release date 2026/07/02

Fixed an issue where the ACL plugin ignored a consumer’s ACL groups when include_consumer_groups was enabled and the consumer belonged to an enterprise consumer group, causing incorrect 403 denials (with allow) or incorrect access (with deny) for authenticated and anonymous consumers. The plugin now falls back to the consumer’s ACL groups when no third-party authenticated groups are present.

Release date 2026/04/28

Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with 403 when include_consumer_groups was enabled and no enterprise consumer groups were assigned.

Release date 2026/04/07

Added WebSocket protocol support (ws/wss). The plugin now enforces allow/deny group rules during the WebSocket handshake phase.

Fixed an issue where the ACL plugin did not check consumer groups from all sources, causing it to incorrectly deny access when consumer groups were set by other plugins like ACE in ngx.ctx.authenticated_consumer_groups.

Release date 2026/04/08

Fixed an issue where anonymous consumers with valid legacy ACL group credentials were rejected with 403 when include_consumer_groups was enabled and no enterprise consumer groups were assigned.

Release date 2026/02/01

Fixed an issue where the ACL plugin did not check consumer groups from all sources, causing it to incorrectly deny access when consumer groups were set by other plugins like ACE in ngx.ctx.authenticated_consumer_groups.