backend: headlamp: filter sensitive headers in external proxy by ayushmaan-16 · Pull Request #5680 · kubernetes-sigs/headlamp

ayushmaan-16 · 2026-05-15T20:47:58Z

Description

Headlamp's external proxy previously forwarded all incoming headers from the user's browser directly to external services (like ArtifactHub) and mishandled HTTP redirects by dropping their Location headers. This posed a security risk (leaking sensitive credentials) and broke functionality for targets utilizing HTTP→HTTPS redirects.

I have fixed these issues by implementing a comprehensive header filtering mechanism and an allowlist-enforced redirect follower.

Changes Made

backend/cmd/headlamp.go:

Comprehensive Header Filtering: Updated the /externalproxy handler to explicitly sanitize incoming headers before forwarding the request. It now strictly removes:
- Security credentials: Authorization, Proxy-Authorization, and Cookie.
- Internal headers: Any header starting with X-HEADLAMP-, proxy-to, and Forward-to.
- Protocol hop-by-hop & connection headers: Connection, Upgrade, Transfer-Encoding, Keep-Alive, Proxy-Connection, TE, Trailer, Accept-Encoding, as well as any dynamic header explicitly listed in the incoming Connection header.
Secure Redirects: Updated the shared HTTP client to securely follow 3xx redirects only if the new redirect target matches the configured ProxyURLs allowlist. Un-followable 3xx responses are explicitly rejected (returning a 502 Bad Gateway) to prevent returning broken redirects to the frontend.

backend/cmd/headlamp_test.go:

Added TestExternalProxyHeaderFiltering to confirm that sensitive and hop-by-hop headers are removed while normal headers are successfully passed through.
Updated TestExternalProxyDoesNotFollowRedirects to verify that disallowed redirects are explicitly blocked.
Added TestExternalProxyFollowsAllowedRedirects to ensure valid allowlist redirects are transparently followed.

How to Test

Run the following commands to verify the comprehensive header filtering and the new redirect handling logic:

cd backend
go test -v ./cmd -run TestExternalProxyHeaderFiltering
go test -v ./cmd -run TestExternalProxyDoesNotFollowRedirects
go test -v ./cmd -run TestExternalProxyFollowsAllowedRedirects

k8s-ci-robot · 2026-05-15T20:48:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ayushmaan-16
Once this PR has been reviewed and has the lgtm label, please assign yolossn for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

illume

Thanks for working on this.

The commit messages could use some tidying up to match our contribution guidelines. We use Linux kernel style — the contributing guide has the details, and git log shows good examples.

Commits that need attention

backend: headlamp: filter sensitive headers in external proxy — Description must start with a capital letter — e.g. frontend: HomeButton: Fix the button not frontend: HomeButton: fix the button.

Commit guidelines

Use atomic commits focused on a single change.
Use the title format <area>: <Description of changes> — description must start with a capital letter.
Keep the title under 72 characters (soft requirement).
Explain the intention and why the change is needed.
Make commit titles meaningful and describe what changed.
Do not add code that a later commit rewrites; squash or reorder commits instead.
Do not include Fixes #NN in commit messages.

Good examples:

frontend: HomeButton: Fix so it navigates to home
backend: config: Add enable-dynamic-clusters flag

Copilot

Pull request overview

This PR hardens the backend /externalproxy endpoint to reduce credential/header leakage when proxying browser requests to allowed external services (e.g., ArtifactHub).

Changes:

Added header filtering in the external proxy request path to avoid forwarding sensitive headers.
Added a regression test intended to ensure sensitive headers are stripped while normal headers are preserved.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
backend/cmd/headlamp.go	Filters selected request headers before forwarding to the external proxy target.
backend/cmd/headlamp_test.go	Adds a regression test covering external proxy header filtering behavior.

Comments suppressed due to low confidence (1)

backend/cmd/headlamp_test.go:2678

The regression test uses "X-Headlamp-Backend-Token"/"X-Headlamp-Custom" (hyphenated) and only asserts for the "X-HEADLAMP-" prefix, but the backend’s sensitive header is actually "X-HEADLAMP_BACKEND-TOKEN" (underscore). Update the test inputs/assertions so it fails if underscore-form internal headers are forwarded, and consider asserting that internal control headers like "proxy-to"/"Forward-to" are not forwarded either.

	// Set sensitive headers that should be filtered
	req.Header.Set("Authorization", "Bearer sensitive-token")
	req.Header.Set("Cookie", "session=sensitive-cookie")
	req.Header.Set("X-Headlamp-Backend-Token", "sensitive-backend-token")
	req.Header.Set("X-Headlamp-Custom", "sensitive-custom-header")

illume

Thanks for the contribution.

Could you take a look at the commit messages in this PR? We follow a Linux kernel style for git commits — see the contributing guide and git log for examples.

Commits that need attention

backend: headlamp: filter sensitive headers in external proxy — Description must start with a capital letter — e.g. frontend: HomeButton: Fix the button not frontend: HomeButton: fix the button.

Commit guidelines

Use atomic commits focused on a single change.
Use the title format <area>: <Description of changes> — description must start with a capital letter.
Keep the title under 72 characters (soft requirement).
Explain the intention and why the change is needed.
Make commit titles meaningful and describe what changed.
Do not add code that a later commit rewrites; squash or reorder commits instead.
Do not include Fixes #NN in commit messages.

Good examples:

frontend: HomeButton: Fix so it navigates to home
backend: config: Add enable-dynamic-clusters flag

The backend test job in CI is failing. Run cd backend && go test ./... to reproduce the errors locally.

How to run the backend tests

Run cd backend && go test ./... to see all failures. Fix the failing tests and commit the result.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

illume

Thanks for working on this.

Looks like there are git conflicts in this PR. Can you fix them up?

How to resolve conflicts

Rebase or merge the latest main into your branch, resolve the conflicts, and push the updated branch.

Would you mind addressing the open Copilot review comments? Please mark each comment as resolved after addressing it.

Prevent external proxy requests from forwarding sensitive auth. Filter internal routing headers before proxying upstream. Add a regression test for Headlamp headers and preserved unrelated headers.

Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

…m URLs Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

Signed-off-by: ayxsh_shxrma <ayushmaan.sharma911@gmail.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

skoeva

the commits can be squashed using git rebase -i

ayushmaan-16 · 2026-06-17T18:57:35Z

@illume @skoeva any other changes that you might wanna address. I'll squash the commit once there are no other technical changes required :). Please review once you guys are free.

illume

Thanks again for this.

Can you please add to the PR description:

How a user can use this? How can we test this manually?
What are the backwards compatibility implications of this?

I asked for a few things to be documented so this is easier to understand and test.

However, this existing headlamp.go code that was there already is quite messy, and it seems this feature is also not documented well (or almost at all really). So I think it might be worth extracting this now into a separate module first before modifying it. Are you up for that? If not that's ok, we can create an issue and maybe someone else can take on that first.

What do you think?

cheers!

illume · 2026-06-23T14:29:50Z

 	return ip != nil && ip.IsLoopback()
 }

+func shouldFilterExternalProxyRequestHeader(headerName string) bool {


We're trying to move everything out of headlamp.go into separate packages/files.

Can you please move these new code into a separate package?

illume · 2026-06-23T14:30:06Z

+	}
+}
+
+func externalProxyConnectionHeaderTokens(headers http.Header) map[string]struct{} {


Can you please add documentation to the new functions?

kubernetes-prow · 2026-06-23T14:38:53Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ayushmaan-16
Once this PR has been reviewed and has the lgtm label, please assign yolossn for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Pragati5-DEBUG · 2026-07-14T07:08:32Z

@ayushmaan-16 — happy to take this: extract externalproxy into a module and carry forward the header/redirect fixes + docs in one PR (or extract first). OK if I open that?

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 15, 2026

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 15, 2026

k8s-ci-robot requested review from ashu8912 and vyncent-t May 15, 2026 20:48

ayushmaan-16 force-pushed the fix-external-proxy-header-leak branch 2 times, most recently from 9a228dc to d1d5908 Compare May 15, 2026 21:02

illume requested a review from Copilot May 16, 2026 10:01

illume requested changes May 16, 2026

View reviewed changes

Copilot started reviewing on behalf of illume May 16, 2026 10:01 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

Comment thread backend/cmd/headlamp.go Outdated

Comment thread backend/cmd/headlamp_test.go

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 16, 2026

illume requested a review from Copilot May 16, 2026 14:50

illume requested changes May 16, 2026

View reviewed changes

Copilot started reviewing on behalf of illume May 16, 2026 14:51 View session

Copilot AI reviewed May 16, 2026

View reviewed changes

Comment thread backend/cmd/headlamp_test.go Outdated

ayushmaan-16 force-pushed the fix-external-proxy-header-leak branch from 0a4bc5a to 860056e Compare May 16, 2026 15:17

ayushmaan-16 requested a review from illume May 16, 2026 15:29

illume requested a review from Copilot May 17, 2026 06:40

Copilot started reviewing on behalf of illume May 17, 2026 06:41 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

Comment thread backend/cmd/headlamp.go

illume requested a review from Copilot May 17, 2026 10:44

Copilot started reviewing on behalf of illume May 17, 2026 10:45 View session

Copilot AI reviewed May 17, 2026

View reviewed changes

Comment thread backend/cmd/headlamp.go Outdated

Comment thread backend/cmd/headlamp.go

Comment thread backend/cmd/headlamp_test.go Outdated

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 17, 2026

illume requested changes May 17, 2026

View reviewed changes

ayushmaan-16 force-pushed the fix-external-proxy-header-leak branch from 6d1dbd0 to eb76287 Compare May 18, 2026 11:46

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label May 18, 2026

ayushmaan-16 requested a review from illume May 18, 2026 20:02

ayushmaan-16 added 10 commits May 29, 2026 15:31

backend: externalproxy: Filter sensitive headers

68b250c

Prevent external proxy requests from forwarding sensitive auth. Filter internal routing headers before proxying upstream. Add a regression test for Headlamp headers and preserved unrelated headers.

backend: externalproxy: Filter protocol headers

4e829dd

backend: externalproxy: Block credential leaks and redirects

8341cf2

backend: externalproxy: Block credential leaks and secure redirects

b77e046

Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

backend: externalproxy: Fix golangci-lint line length and wsl errors

19957a4

Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

backend: externalproxy: Return generic error to avoid leaking upstrea…

256babd

…m URLs Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

backend: externalproxy: Fix lll lint error on redirect error message

c238307

Signed-off-by: ayushmaan-16 <ayushmaan.sharma911@gmail.com>

backend: externalproxy: Precompile redirect allowlist

d4cd195

backend: externalproxy: Fix header leak review comments

ef91b57

Signed-off-by: ayxsh_shxrma <ayushmaan.sharma911@gmail.com>

backend: externalproxy: Fix golangci-lint unparam and wsl errors

bcdab72

Signed-off-by: ayxsh_shxrma <ayushmaan.sharma911@gmail.com>

ayushmaan-16 force-pushed the fix-external-proxy-header-leak branch from f37af33 to bcdab72 Compare June 5, 2026 13:41

ayushmaan-16 requested a review from illume June 5, 2026 13:58

illume requested a review from Copilot June 7, 2026 08:51

Copilot started reviewing on behalf of illume June 7, 2026 08:52 View session

Copilot AI reviewed Jun 7, 2026

View reviewed changes

illume added the needs review label Jun 7, 2026

skoeva requested changes Jun 10, 2026

View reviewed changes

illume added the security label Jun 23, 2026

illume requested changes Jun 23, 2026

View reviewed changes

Pragati5-DEBUG mentioned this pull request Jul 15, 2026

backend: externalproxy: Extract module and harden proxy headers #6516

Open

3 tasks

illume added backend Issues related to the backend kind/bug Categorizes issue or PR as related to a bug. testing labels Jul 25, 2026

illume added this to the v0.44.0 milestone Jul 27, 2026

illume assigned sniok Jul 27, 2026

illume modified the milestones: v0.44.0, v0.45.0 Jul 28, 2026

Uh oh!

Conversation

ayushmaan-16 commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes Made

How to Test

Uh oh!

k8s-ci-robot commented May 15, 2026

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

skoeva left a comment

Choose a reason for hiding this comment

Uh oh!

ayushmaan-16 commented Jun 17, 2026

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

illume Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

kubernetes-prow Bot commented Jun 23, 2026

Uh oh!

Pragati5-DEBUG commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

ayushmaan-16 commented May 15, 2026 •

edited

Loading