Basic Auth

Release date 2026/09/16

Bugfix

• Fixed an issue where invalid credentials were not falling back to the configured anonymous consumer when principals.error_on_miss was set to false, unlike every other authentication failure.

Release date 2026/07/02

Feature

• Added support for authentication via the Kong Identity service with caching, consumer compatibility, and basic analytics.

Release date 2026/04/07

Feature

• Uses SHA256 by default even in non-FIPS mode instead of SHA1.

Bugfix

• Brute Force Protection: when using redis strategy and the connection fails, the plugin will now fall back to using the memory strategy.

Release date 2025/12/18

Feature

• Added brute force protection with exponential backoff for failed login attempts.

Release date 2025/03/27

Bugfix

• Improved the error message which occurred when an anonymous consumer was configured but did not exist.

Release date 2024/09/11

Bugfix

• Fix an issue of realm field not recognized for older kong versions (before 3.6)

Release date 2024/06/18

Bugfix

• Fix an issue of realm field not recognized for older kong versions (before 3.6)

Release date 2024/06/18

Bugfix

• Fix an issue of realm field not recognized for older kong versions (before 3.6)

Release date 2024/02/12

Bugfix

• Add missing WWW-Authenticate headers to 401 response in basic auth plugin.

Release date 2023/11/08

Bugfix

• Enhance error responses for authentication failures in the Admin API

Release date 2022/12/06

Feature

• The anonymous field can now be configured as the username of the consumer. This field allows you to configure a string to use as an “anonymous” consumer if authentication fails.

Release date 2022/09/09

Breaking Change

• Updated the priority for some plugins.: basic-auth changed from 1001 to 1100