Environment: container with image tykio/tyk-gateway:${GATEWAY_VERSION:-v3.1.0}
Describe the bug
Tyk Gateway allows to send requests on endpoint in the whitelist if there is almost the same, but without parameters (see whitelist and track_endpoints section in an example API).
Reproduction steps
Steps to reproduce the behavior:
Actual behavior
When I tested my API whitelist for /admin/users/{userId} endpoint did not work as expected.
curl --location --request GET 'http://api-gateway.service.test/admin/users/1' - worked as expected
curl --location --request POST 'http://api-gateway.service.test/admin/users/1' - should be blocked by Tyk whitelist filter with 403 response, but Tyk bypassed this request to the service and API service responsed with 404 error. After I've deleted endpoint /admin/users from track_endpoints and whitelist section and reloaded Tyk everything began to work right.
Expected behavior
Tyk should examine endpoint for parameters and do not allow requests for endpoints with wrong method.
Screenshots/Video
No
Logs (debug mode or log file):
I can provide if needed.
@renta Thanks for contacting Tyk!
We apologize for the delayed response. The issue is currently being reviewed and we will keep you updated as soon as we can
Branch/Environment/Version
Describe the bug Tyk Gateway allows to send requests on endpoint in the whitelist if there is almost the same, but without parameters (see whitelist and track_endpoints section in an example API).
Reproduction steps Steps to reproduce the behavior:
Actual behavior When I tested my API whitelist for /admin/users/{userId} endpoint did not work as expected. curl --location --request GET 'http://api-gateway.service.test/admin/users/1' - worked as expected curl --location --request POST 'http://api-gateway.service.test/admin/users/1' - should be blocked by Tyk whitelist filter with 403 response, but Tyk bypassed this request to the service and API service responsed with 404 error. After I've deleted endpoint /admin/users from track_endpoints and whitelist section and reloaded Tyk everything began to work right.
Expected behavior Tyk should examine endpoint for parameters and do not allow requests for endpoints with wrong method.
Screenshots/Video No
Logs (debug mode or log file): I can provide if needed.
Configuration (tyk config file):
Additional context Does this issue related to https://github.com/TykTechnologies/tyk/issues/2933 and https://github.com/TykTechnologies/tyk/issues/1944 ?