1
hello-plugin/
2
├── go.mod
3
├── go.sum
4
├── main.go           # 插件入口
5
├── plugin.yaml       # 插件元数据（可选）
6
└── README.md

1
package main
2

3
import (
4
  "github.com/higress-group/wasm-go/pkg/wrapper"
5
  "github.com/tidwall/gjson"
6
)
7

8
func main() {
9
  wrapper.SetCtx(
10
    // 插件名称
11
    "hello-plugin",
12
    // 解析配置
13
    wrapper.ParseConfigBy(parseConfig),
14
    // 处理请求头
15
    wrapper.ProcessRequestHeadersBy(onHttpRequestHeaders),
16
  )
17
}
18

19
// 插件配置结构
20
type HelloConfig struct {
21
  Message string `json:"message"`
22
}
23

24
// 解析配置（JSON 格式）
25
func parseConfig(json gjson.Result, config *HelloConfig, log wrapper.Log) error {
26
  config.Message = json.Get("message").String()
27
  if config.Message == "" {
28
    config.Message = "Hello from Higress Wasm Plugin!"
29
  }
30
  log.Infof("Config loaded: message=%s", config.Message)
31
  return nil
32
}
33

34
// 处理请求头
35
func onHttpRequestHeaders(ctx wrapper.HttpContext, config HelloConfig, log wrapper.Log) wrapper.Action {
36
  // 添加自定义 Header
37
  ctx.SetRequestHeader("X-Hello-Message", config.Message)
38

39
  // 记录日志
40
  log.Infof("Request path: %s", ctx.Path())
41

42
  // 继续处理
43
  return wrapper.ActionContinue
44
}

1
module hello-plugin
2

3
go 1.24
4

5
require (
6
  github.com/higress-group/wasm-go v1.0.0
7
  github.com/tidwall/gjson v1.17.0
8
)

1
// 设置插件上下文
2
wrapper.SetCtx(
3
  name string,                    // 插件名称
4
  opts ...WrapperOption,          // 配置选项
5
)
6

7
// 配置选项
8
wrapper.ParseConfigBy(parseFunc)   // 配置解析函数
9
wrapper.ProcessRequestHeadersBy(fn)  // 请求头处理
10
wrapper.ProcessRequestBodyBy(fn)     // 请求体处理
11
wrapper.ProcessResponseHeadersBy(fn) // 响应头处理
12
wrapper.ProcessResponseBodyBy(fn)    // 响应体处理
13
wrapper.ProcessLogBy(fn)             // 日志处理

1
type HttpContext interface {
2
  // 请求信息
3
  Path() string                    // 请求路径
4
  Method() string                  // HTTP 方法
5
  Host() string                    // Host Header
6
  Scheme() string                  // http / https
7

8
  // Header 操作
9
  GetRequestHeader(key string) (string, error)
10
  SetRequestHeader(key, value string) error
11
  RemoveRequestHeader(key string) error
12

13
  GetResponseHeader(key string) (string, error)
14
  SetResponseHeader(key, value string) error
15

16
  // Body 操作
17
  GetRequestBody() ([]byte, error)
18
  SetRequestBody(body []byte) error
19

20
  // 查询参数
21
  QueryParam(key string) (string, bool)
22

23
  // 客户端 IP
24
  ClientIP() string
25

26
  // 路由信息
27
  RouteName() string
28

29
  // 共享数据（跨请求）
30
  GetSharedData(key string) ([]byte, error)
31
  SetSharedData(key string, value []byte, cas uint64) error
32

33
  // 直接响应（中断请求）
34
  SendHttpResponse(statusCode int, headers map[string]string, body []byte, grpcStatus int) error
35
}

1
import "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
2

3
// 日志
4
proxywasm.LogDebug("debug message")
5
proxywasm.LogInfo("info message")
6
proxywasm.LogWarn("warning message")
7
proxywasm.LogError("error message")
8

9
// Header 操作
10
proxywasm.GetHttpRequestHeader("key")
11
proxywasm.AddHttpRequestHeader("key", "value")
12
proxywasm.ReplaceHttpRequestHeader("key", "value")
13
proxywasm.RemoveHttpRequestHeader("key")
14

15
// HTTP 调用（异步）
16
proxywasm.DispatchHttpCall(
17
  cluster string,           // 上游集群名
18
  headers [][2]string,      // 请求头
19
  body []byte,              // 请求体
20
  trailers [][2]string,     // Trailer
21
  timeout uint32,           // 超时（毫秒）
22
  callback func(numHeaders, bodySize, numTrailers int),  // 回调
23
)
24

25
// 发送响应
26
proxywasm.SendHttpResponse(
27
  statusCode uint32,
28
  headers [][2]string,
29
  body []byte,
30
  grpcStatus int32,
31
)

1
package main
2

3
import (
4
  "crypto/rsa"
5
  "encoding/base64"
6
  "encoding/json"
7
  "fmt"
8
  "strings"
9
  "time"
10

11
  "github.com/golang-jwt/jwt/v5"
12
  "github.com/higress-group/wasm-go/pkg/wrapper"
13
  "github.com/tidwall/gjson"
14
)
15

16
func main() {
17
  wrapper.SetCtx(
18
    "jwt-auth",
19
    wrapper.ParseConfigBy(parseConfig),
20
    wrapper.ProcessRequestHeadersBy(onHttpRequestHeaders),
21
  )
22
}
23

24
type JWTConfig struct {
25
  Issuer     string            `json:"issuer"`
26
  JWKSUri    string            `json:"jwks_uri"`
27
  PublicKey  *rsa.PublicKey    `json:"-"`
28
  WhiteList  []string          `json:"white_list"`
29
  ClaimsToForward []string     `json:"claims_to_forward"`
30
}
31

32
func parseConfig(json gjson.Result, config *JWTConfig, log wrapper.Log) error {
33
  config.Issuer = json.Get("issuer").String()
34
  config.JWKSUri = json.Get("jwks_uri").String()
35

36
  // 解析白名单
37
  for _, item := range json.Get("white_list").Array() {
38
    config.WhiteList = append(config.WhiteList, item.String())
39
  }
40

41
  // 解析需要透传的 Claims
42
  for _, item := range json.Get("claims_to_forward").Array() {
43
    config.ClaimsToForward = append(config.ClaimsToForward, item.String())
44
  }
45

46
  // 从 JWKS URI 获取公钥（简化示例，实际需缓存和刷新）
47
  log.Infof("Loading JWKS from: %s", config.JWKSUri)
48
  // TODO: 实现 JWKS 获取和缓存
49

50
  return nil
51
}
52

53
func onHttpRequestHeaders(ctx wrapper.HttpContext, config JWTConfig, log wrapper.Log) wrapper.Action {
54
  path := ctx.Path()
55

56
  // 白名单路径跳过认证
57
  for _, whitePath := range config.WhiteList {
58
    if strings.HasPrefix(path, whitePath) {
59
      log.Debugf("Path %s in whitelist, skip auth", path)
60
      return wrapper.ActionContinue
61
    }
62
  }
63

64
  // 提取 Authorization Header
65
  authHeader, err := ctx.GetRequestHeader("Authorization")
66
  if err != nil || authHeader == "" {
67
    log.Warnf("Missing Authorization header")
68
    ctx.SendHttpResponse(401, map[string]string{
69
      "Content-Type": "application/json",
70
    }, []byte(`{"error":"unauthorized","message":"Missing Authorization header"}`), -1)
71
    return wrapper.ActionStop
72
  }
73

74
  // 提取 Bearer Token
75
  tokenString := strings.TrimPrefix(authHeader, "Bearer ")
76
  if tokenString == authHeader {
77
    log.Warnf("Invalid Authorization format")
78
    ctx.SendHttpResponse(401, map[string]string{
79
      "Content-Type": "application/json",
80
    }, []byte(`{"error":"unauthorized","message":"Invalid Authorization format"}`), -1)
81
    return wrapper.ActionStop
82
  }
83

84
  // 解析并验证 Token
85
  token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
86
    // 验证签名算法
87
    if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
88
      return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
89
    }
90
    return config.PublicKey, nil
91
  })
92

93
  if err != nil {
94
    log.Warnf("Token validation failed: %v", err)
95
    ctx.SendHttpResponse(401, map[string]string{
96
      "Content-Type": "application/json",
97
    }, []byte(fmt.Sprintf(`{"error":"unauthorized","message":"%s"}`, err.Error())), -1)
98
    return wrapper.ActionStop
99
  }
100

101
  if !token.Valid {
102
    log.Warnf("Token is not valid")
103
    ctx.SendHttpResponse(401, map[string]string{
104
      "Content-Type": "application/json",
105
    }, []byte(`{"error":"unauthorized","message":"Token is not valid"}`), -1)
106
    return wrapper.ActionStop
107
  }
108

109
  // 验证 Claims
110
  if claims, ok := token.Claims.(jwt.MapClaims); ok {
111
    // 验证 issuer
112
    if config.Issuer != "" {
113
      if iss, ok := claims["iss"].(string); !ok || iss != config.Issuer {
114
        log.Warnf("Invalid issuer: %v", claims["iss"])
115
        ctx.SendHttpResponse(401, map[string]string{
116
          "Content-Type": "application/json",
117
        }, []byte(`{"error":"unauthorized","message":"Invalid issuer"}`), -1)
118
        return wrapper.ActionStop
119
      }
120
    }
121

122
    // 透传 Claims 到上游
123
    for _, claimKey := range config.ClaimsToForward {
124
      if value, ok := claims[claimKey]; ok {
125
        headerKey := fmt.Sprintf("X-JWT-%s", strings.ToUpper(claimKey))
126
        valueStr := fmt.Sprintf("%v", value)
127
        ctx.SetRequestHeader(headerKey, valueStr)
128
      }
129
    }
130

131
    log.Infof("JWT auth success, sub=%v", claims["sub"])
132
  }
133

134
  return wrapper.ActionContinue
135
}

1
apiVersion: extensions.higress.io/v1alpha1
2
kind: WasmPlugin
3
metadata:
4
  name: jwt-auth
5
  namespace: higress-system
6
spec:
7
  url: oci://registry.example.com/plugins/jwt-auth:v1
8
  phase: AUTHN
9
  priority: 1000
10
  defaultConfig:
11
    issuer: "https://auth.example.com"
12
    jwks_uri: "https://auth.example.com/.well-known/jwks.json"
13
    white_list:
14
      - "/api/health"
15
      - "/api/public"
16
      - "/api/login"
17
    claims_to_forward:
18
      - "sub"
19
      - "email"
20
      - "roles"

1
package main
2

3
import (
4
  "encoding/json"
5
  "fmt"
6

7
  "github.com/higress-group/wasm-go/pkg/wrapper"
8
  "github.com/tidwall/gjson"
9
  "github.com/tetratelabs/proxy-wasm-go-sdk/proxywasm"
10
)
11

12
type ExternalAPIConfig struct {
13
  ClusterName string `json:"cluster_name"`
14
  Timeout     uint32 `json:"timeout_ms"`
15
}
16

17
func onHttpRequestHeaders(ctx wrapper.HttpContext, config ExternalAPIConfig, log wrapper.Log) wrapper.Action {
18
  // 暂停请求，等待异步调用完成
19
  return wrapper.ActionPause
20
}
21

22
func callExternalService(ctx wrapper.HttpContext, config ExternalAPIConfig, log wrapper.Log) {
23
  // 构造请求
24
  headers := [][2]string{
25
    {":method", "GET"},
26
    {":path", "/api/user-info"},
27
    {":authority", "user-service.internal"},
28
    {"X-Request-ID", ctx.GetRequestHeader("X-Request-ID")},
29
  }
30

31
  // 发起异步 HTTP 调用
32
  _, err := proxywasm.DispatchHttpCall(
33
    config.ClusterName,      // 上游集群名
34
    headers,
35
    nil,                     // 请求体
36
    nil,                     // Trailer
37
    config.Timeout,          // 超时（毫秒）
38
    func(numHeaders, bodySize, numTrailers int) {
39
      // 回调函数（异步执行）
40
      body, err := proxywasm.GetHttpCallResponseBody(0, bodySize)
41
      if err != nil {
42
        log.Errorf("Failed to get response body: %v", err)
43
        ctx.SendHttpResponse(500, nil, []byte("Internal Error"), -1)
44
        return
45
      }
46

47
      // 解析响应
48
      var result map[string]interface{}
49
      json.Unmarshal(body, &result)
50

51
      // 提取用户信息，添加到请求头
52
      if userID, ok := result["user_id"].(string); ok {
53
        ctx.SetRequestHeader("X-User-ID", userID)
54
      }
55

56
      // 继续处理原始请求
57
      proxywasm.ResumeHttpRequest()
58
    },
59
  )
60

61
  if err != nil {
62
    log.Errorf("Failed to dispatch HTTP call: %v", err)
63
    ctx.SendHttpResponse(500, nil, []byte("Internal Error"), -1)
64
  }
65
}

1
// 使用 wrapper.Log
2
log.Debugf("Debug: %v", data)      // 开发环境
3
log.Infof("Info: %s", msg)          // 生产环境
4
log.Warnf("Warning: %v", err)       // 警告
5
log.Errorf("Error: %v", err)        // 错误
6

7
// 查看日志
8
kubectl logs -n higress-system deploy/higress-gateway -f | grep hello-plugin

1
// 增加超时时间
2
proxywasm.DispatchHttpCall(
3
  cluster,
4
  headers,
5
  body,
6
  trailers,
7
  5000,  // 5 秒（默认 1 秒）
8
  callback,
9
)
10

11
// 确认 Cluster 配置正确
12
// 在 Higress 中注册外部服务（McpBridge）