Kong Gateway

Antacid Kong plugin

Audit-only plugin: detects secrets in requests, logs secret key, semi-masked value, and user id, never blocks or modifies traffic, and serves a simple Admin UI.

Install

From this repository on the Kong node:

# on the Kong node
luarocks make kong-plugin-antacid-0.1.0-1.rockspec

Or add the plugin path to lua_package_path and enable the plugin name.

Shared memory (required for UI / event buffer)

In kong.conf:

plugins = bundled,antacid
nginx_http_lua_shared_dict = antacid_events 5m

Or an nginx directive:

lua_shared_dict antacid_events 5m;

Restart Kong after changing shared dict settings.

Enable on a route / service / global

Admin API example (global):

curl -s -X POST http://localhost:8001/plugins \
  --data "name=antacid" \
  --data "config.user_id_header=X-User-Id" \
  --data "config.scan_body=true" \
  --data "config.scan_headers=true" \
  --data "config.max_events=200"

Declarative (kong.yml):

plugins:
  - name: antacid
    config:
      user_id_header: X-User-Id
      scan_body: true
      scan_headers: true
      max_events: 200

View events

Open the Admin UI:

http://localhost:8001/antacid

JSON API:

curl -s http://localhost:8001/antacid/events | jq .

Clear in-memory buffer:

curl -s -X DELETE http://localhost:8001/antacid/events

Events are node-local (shared dict ring buffer, default 200). They are not replicated across Kong nodes.

What gets logged

Field	Meaning
`secret_key`	Sensitive field name or matched value prefix
`secret_masked`	Semi-masked value (`abcd**wxyz`; short values → `**`)
`user_id`	Kong consumer → `X-User-Id` / `X-Consumer-Username` → `anonymous`
`ts`	UTC timestamp
`route_id` / `service_id`	Kong route/service when available

Full secret values are never written to the event store or UI.

Detection

Deterministic only:

JSON body keys matching sensitive name patterns (SECRET, TOKEN, API_KEY, …)
Known value prefixes (sk-, sk_test_, ghp_, AKIA, sk-ant-, …)
Sensitive request headers

Local unit tests

lua spec/antacid/mask_spec.lua

End-to-end (Docker)

Requires Docker Desktop. Starts Kong 3.8 (DB-less) + httpbin, enables Antacid, posts a secret, asserts the Admin UI/events API.

cd ~/Projects/antacid   # or your clone path
./kong/e2e/run.sh

Or keep the stack up and open the UI:

docker compose -f kong/e2e/docker-compose.yml up -d
open http://127.0.0.1:8001/antacid

Layout

kong/plugins/antacid/
  handler.lua    # access phase
  schema.lua
  api.lua        # /antacid + /antacid/events
  events.lua     # shared-dict ring buffer
  mask.lua       # detect + semi-mask
  ui.html / ui_data.lua

View plugin source Back to home