kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sys-svc-proxy): strip forgeable identity headers on every proxy location to close trusted-header injection (snipe-it)

Browse Source
This commit is contained in:
kevinveenbirkenbach committed 2026-06-17 11:30:39 +02:00
1 parent 16d435c525
commit b8759a363e
4 files changed
+21 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

roles/sys-svc-proxy/templates/headers/identity_request_strips.conf.j2
+7
View File
@@ -0,0 +1,7 @@
# Strip client-supplied identity headers on non-SSO-gated locations so they cannot be forged.
proxy_set_header X-Forwarded-User "";
proxy_set_header X-Forwarded-Preferred-Username "";
proxy_set_header X-Forwarded-Email "";
proxy_set_header X-Forwarded-Groups "";
proxy_set_header X-Forwarded-Access-Token "";
{% include 'roles/sys-svc-proxy/templates/headers/untrusted_identity_strips.conf.j2' %}
roles/sys-svc-proxy/templates/headers/untrusted_identity_strips.conf.j2
+10
View File
@@ -0,0 +1,10 @@
# Identity headers oauth2-proxy never sets upstream; always cleared so a client cannot forge them.
proxy_set_header Remote-User "";
proxy_set_header Remote-Groups "";
proxy_set_header Remote-Email "";
proxy_set_header Remote-Name "";
proxy_set_header X-Auth-Request-User "";
proxy_set_header X-Auth-Request-Preferred-Username "";
proxy_set_header X-Auth-Request-Email "";
proxy_set_header X-Auth-Request-Groups "";
proxy_set_header X-Auth-Request-Access-Token "";
roles/sys-svc-proxy/templates/location/html.conf.j2
+2
View File
@@ -3,6 +3,8 @@ location {{location}}
{
{% if sso_proxy_enabled | default(false) | bool %}
{% include 'roles/web-app-keycloak/templates/sso_proxy/following_directives.conf.j2'%}
{% else %}
{% include 'roles/sys-svc-proxy/templates/headers/identity_request_strips.conf.j2'%}
{% endif %}
{% include 'roles/sys-svc-proxy/templates/headers/content_security_policy.conf.j2' %}
roles/web-app-keycloak/templates/sso_proxy/following_directives.conf.j2
+2 -1
View File
@@ -23,4 +23,5 @@ proxy_set_header X-Forwarded-User $authrequest_user;
proxy_set_header X-Forwarded-Preferred-Username $authrequest_username;
proxy_set_header X-Forwarded-Email $authrequest_email;
proxy_set_header X-Forwarded-Groups $authrequest_groups;
proxy_set_header X-Forwarded-Access-Token $authrequest_accesstoken;
proxy_set_header X-Forwarded-Access-Token $authrequest_accesstoken;
{% include 'roles/sys-svc-proxy/templates/headers/untrusted_identity_strips.conf.j2' %}