Read the forwarded client credential only when an edge announced it - #34
Open
0bserver07 wants to merge 1 commit into
Open
Read the forwarded client credential only when an edge announced it#340bserver07 wants to merge 1 commit into
0bserver07 wants to merge 1 commit into
Conversation
client_authorization in crates/walgit-server/src/auth.rs:897 read X-Walgit-Authorization before it checked anything else, so a client talking to walgit directly could put a credential in that header and have it taken as the client credential. AGENTS.md D39 (2) and section 1.3 say the forwarded copy counts only when an edge announced client-authorization in X-Walgit-Capabilities on that request, and that nothing is assumed when walgit is hit with nothing in front of it. The function now consults edge_owns_authorization first and returns the plain Authorization header value when no capability was announced, reaching for the forwarded copy only behind an announcing edge. Behaviour behind an edge is unchanged, a missing forwarded copy there still meaning the client sent no credential. The unit test edge_owned_authorization_is_not_the_client now covers the direction that was missing: Authorization Bearer a with X-Walgit-Authorization Bearer b and no capability header yields a, and the same two headers with the capability yield b. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
client_authorizationincrates/walgit-server/src/auth.rsreadX-Walgit-Authorizationbefore checking whether an edge had announcedclient-authorizationinX-Walgit-Capabilities. So a client talking to walgit directly could put a credential in the forwarded header and have it taken as its own. AGENTS.md D39 (2) and section 1.3 say the forwarded copy only counts behind an edge that announced it, and that nothing is assumed when walgit is hit directly.Now the capability is checked first. Without it,
Authorizationis the client's and the forwarded header isn't read at all; with it, the forwarded copy is used and a missing copy still means no client credential, as before. Nobody gets in without a valid credential either way, since whatever comes back still goes through the same verification; this only makes which header is read match D39.The unit test
edge_owned_authorization_is_not_the_clientnow covers the missing direction:Bearer ainAuthorizationplusBearer bforwarded yieldsawithout the capability andbwith it. Checked withcargo test -p walgit-server --lib auth::(14 pass). Not exercised behind a real nginx.Same pass as #25, #26, #27, #28, #29.