Skip to content

Commit 2dbcdef

Browse files
NucleiAvNucleiAv
authored
forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
When using copy_headers in a forward_auth block, client-supplied headers with the same names were not being removed before being forwarded to the backend. This happens because PR #6608 added a MatchNot guard that skips the Set operation when the auth service does not return a given header. That guard prevents setting headers to empty strings, which is the correct behavior, but it also means a client can send X-User-Id: admin in their request and if the auth service validates the token without returning X-User-Id, Caddy skips the Set and the client value passes through unchanged to the backend. The fix adds an unconditional delete route for each copy_headers entry, placed just before the existing conditional set route. The delete always runs regardless of what the auth service returns. The conditional set still only runs when the auth service provides that header. The end result is: - Client-supplied headers are always removed - When the auth service returns the header, the backend gets that value - When the auth service does not return the header, the backend sees nothing Existing behavior is unchanged for any deployment where the auth service returns all of the configured copy_headers entries. Fixes GHSA-7r4p-vjf4-gxv4
1 parent dc36082 commit 2dbcdef

File tree

5 files changed

+480
-2
lines changed

5 files changed

+480
-2
lines changed

‎caddytest/integration/caddyfile_adapt/forward_auth_authelia.caddyfiletest‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,18 @@ app.example.com {
4646
}
4747
]
4848
},
49+
{
50+
"handle": [
51+
{
52+
"handler": "headers",
53+
"request": {
54+
"delete": [
55+
"Remote-Email"
56+
]
57+
}
58+
}
59+
]
60+
},
4961
{
5062
"handle": [
5163
{
@@ -73,6 +85,18 @@ app.example.com {
7385
}
7486
]
7587
},
88+
{
89+
"handle": [
90+
{
91+
"handler": "headers",
92+
"request": {
93+
"delete": [
94+
"Remote-Groups"
95+
]
96+
}
97+
}
98+
]
99+
},
76100
{
77101
"handle": [
78102
{
@@ -100,6 +124,18 @@ app.example.com {
100124
}
101125
]
102126
},
127+
{
128+
"handle": [
129+
{
130+
"handler": "headers",
131+
"request": {
132+
"delete": [
133+
"Remote-Name"
134+
]
135+
}
136+
}
137+
]
138+
},
103139
{
104140
"handle": [
105141
{
@@ -127,6 +163,18 @@ app.example.com {
127163
}
128164
]
129165
},
166+
{
167+
"handle": [
168+
{
169+
"handler": "headers",
170+
"request": {
171+
"delete": [
172+
"Remote-User"
173+
]
174+
}
175+
}
176+
]
177+
},
130178
{
131179
"handle": [
132180
{
@@ -200,4 +248,4 @@ app.example.com {
200248
}
201249
}
202250
}
203-
}
251+
}

‎caddytest/integration/caddyfile_adapt/forward_auth_copy_headers_strip.caddyfiletest‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
:8080
2+
3+
forward_auth 127.0.0.1:9091 {
4+
uri /
5+
copy_headers X-User-Id X-User-Role
6+
}
7+
----------
8+
{
9+
"apps": {
10+
"http": {
11+
"servers": {
12+
"srv0": {
13+
"listen": [
14+
":8080"
15+
],
16+
"routes": [
17+
{
18+
"handle": [
19+
{
20+
"handle_response": [
21+
{
22+
"match": {
23+
"status_code": [
24+
2
25+
]
26+
},
27+
"routes": [
28+
{
29+
"handle": [
30+
{
31+
"handler": "vars"
32+
}
33+
]
34+
},
35+
{
36+
"handle": [
37+
{
38+
"handler": "headers",
39+
"request": {
40+
"delete": [
41+
"X-User-Id"
42+
]
43+
}
44+
}
45+
]
46+
},
47+
{
48+
"handle": [
49+
{
50+
"handler": "headers",
51+
"request": {
52+
"set": {
53+
"X-User-Id": [
54+
"{http.reverse_proxy.header.X-User-Id}"
55+
]
56+
}
57+
}
58+
}
59+
],
60+
"match": [
61+
{
62+
"not": [
63+
{
64+
"vars": {
65+
"{http.reverse_proxy.header.X-User-Id}": [
66+
""
67+
]
68+
}
69+
}
70+
]
71+
}
72+
]
73+
},
74+
{
75+
"handle": [
76+
{
77+
"handler": "headers",
78+
"request": {
79+
"delete": [
80+
"X-User-Role"
81+
]
82+
}
83+
}
84+
]
85+
},
86+
{
87+
"handle": [
88+
{
89+
"handler": "headers",
90+
"request": {
91+
"set": {
92+
"X-User-Role": [
93+
"{http.reverse_proxy.header.X-User-Role}"
94+
]
95+
}
96+
}
97+
}
98+
],
99+
"match": [
100+
{
101+
"not": [
102+
{
103+
"vars": {
104+
"{http.reverse_proxy.header.X-User-Role}": [
105+
""
106+
]
107+
}
108+
}
109+
]
110+
}
111+
]
112+
}
113+
]
114+
}
115+
],
116+
"handler": "reverse_proxy",
117+
"headers": {
118+
"request": {
119+
"set": {
120+
"X-Forwarded-Method": [
121+
"{http.request.method}"
122+
],
123+
"X-Forwarded-Uri": [
124+
"{http.request.uri}"
125+
]
126+
}
127+
}
128+
},
129+
"rewrite": {
130+
"method": "GET",
131+
"uri": "/"
132+
},
133+
"upstreams": [
134+
{
135+
"dial": "127.0.0.1:9091"
136+
}
137+
]
138+
}
139+
]
140+
}
141+
]
142+
}
143+
}
144+
}
145+
}
146+
}

‎caddytest/integration/caddyfile_adapt/forward_auth_rename_headers.caddyfiletest‎

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ forward_auth localhost:9000 {
3535
}
3636
]
3737
},
38+
{
39+
"handle": [
40+
{
41+
"handler": "headers",
42+
"request": {
43+
"delete": [
44+
"1"
45+
]
46+
}
47+
}
48+
]
49+
},
3850
{
3951
"handle": [
4052
{
@@ -62,6 +74,18 @@ forward_auth localhost:9000 {
6274
}
6375
]
6476
},
77+
{
78+
"handle": [
79+
{
80+
"handler": "headers",
81+
"request": {
82+
"delete": [
83+
"B"
84+
]
85+
}
86+
}
87+
]
88+
},
6589
{
6690
"handle": [
6791
{
@@ -89,6 +113,18 @@ forward_auth localhost:9000 {
89113
}
90114
]
91115
},
116+
{
117+
"handle": [
118+
{
119+
"handler": "headers",
120+
"request": {
121+
"delete": [
122+
"3"
123+
]
124+
}
125+
}
126+
]
127+
},
92128
{
93129
"handle": [
94130
{
@@ -116,6 +152,18 @@ forward_auth localhost:9000 {
116152
}
117153
]
118154
},
155+
{
156+
"handle": [
157+
{
158+
"handler": "headers",
159+
"request": {
160+
"delete": [
161+
"D"
162+
]
163+
}
164+
}
165+
]
166+
},
119167
{
120168
"handle": [
121169
{
@@ -143,6 +191,18 @@ forward_auth localhost:9000 {
143191
}
144192
]
145193
},
194+
{
195+
"handle": [
196+
{
197+
"handler": "headers",
198+
"request": {
199+
"delete": [
200+
"5"
201+
]
202+
}
203+
}
204+
]
205+
},
146206
{
147207
"handle": [
148208
{
@@ -203,4 +263,4 @@ forward_auth localhost:9000 {
203263
}
204264
}
205265
}
206-
}
266+
}

0 commit comments

Comments
 (0)