fix: harden gateway auth with timing-safe compare, null checks, trust proxy#137
Merged
fix: harden gateway auth with timing-safe compare, null checks, trust proxy#137
Conversation
… proxy - match-events gateway: use crypto.timingSafeEqual for password comparison, add null checks on auth header and credentials, reject connections without auth header, use indexOf for safer credential parsing - match-relay middleware: add null/type check on x-origin-auth header before parsing, use timing-safe comparison for password verification - main.ts: replace trust-all proxy with trust-first-proxy (1) for NGINX ingress, removing the TODO placeholder Closes 5stackgg/5stack-panel#371 Closes 5stackgg/5stack-panel#372
Contributor
|
TY TY this is huge! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three authentication hardening improvements:
Match events gateway — Replaced
!==password comparison withcrypto.timingSafeEqualto prevent timing attacks. Added null checks on auth header and base64 credentials. Connections without auth headers are now explicitly rejected. UsesindexOffor credential parsing instead ofsplit(safer with passwords containing:).Match relay middleware — Added null/type check on
x-origin-authheader before parsing. Uses timing-safe comparison for password verification. Safely handles missing or malformed headers with 401.Trust proxy — Replaced
() => true(trust all) with1(trust first proxy only), which is the standard for apps behind a single NGINX ingress controller.Test plan
req.ipreturns the real client IP (not the proxy IP)Closes 5stackgg/5stack-panel#371
Closes 5stackgg/5stack-panel#372