Harden CORS and reporting endpoint enforcement

Author: eldryoth

CHANGELOG.md

@@ -42,6 +42,9 @@ behavior when the change improves security or project direction.
   named `Domain` or `Path` as a `Set-Cookie` attribute.
 - Add fuzz coverage for the header parsers and rewrite boundaries changed by
   this hardening pass.
+- Enforce configured CORS methods on actual responses, not only preflights.
+- Serialize Reporting-Endpoints as a bounded RFC 9651 dictionary with strict
+  lowercase keys, escaped ASCII strings, and HTTPS-only collectors.
 
 ## 1.7.9 - 2026-07-12
 

crates/fluxheim-config/src/config_header_hardening.rs

@@ -3,10 +3,12 @@ use std::collections::BTreeMap;
 use serde::{Deserialize, Serialize};
 
 use crate::config::ConfigError;
-use crate::config_header_validation::{valid_http_header_name, validate_optional_header_value};
+use crate::config_header_validation::validate_optional_header_value;
 use crate::config_http::valid_http_endpoint_url;
 
 const MAX_REPORTING_ENDPOINTS: usize = 16;
+const MAX_REPORTING_ENDPOINT_NAME_BYTES: usize = 64;
+const MAX_REPORTING_ENDPOINTS_HEADER_BYTES: usize = 16_384;
 
 #[derive(Debug, Clone, Copy, Default, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(rename_all = "kebab-case")]
@@ -148,28 +150,88 @@ pub(crate) fn validate_reporting_endpoints(
         return Err(ConfigError::InvalidResponseHeaderValue { field });
     }
     for (name, endpoint) in endpoints {
-        if !valid_http_header_name(name) || !valid_http_endpoint_url(endpoint) {
+        if !valid_structured_field_key(name)
+            || !endpoint.starts_with("https://")
+            || !valid_http_endpoint_url(endpoint)
+            || serialize_sf_string(endpoint).is_none()
+        {
             return Err(ConfigError::InvalidHeaderValue {
                 field,
                 name: name.clone(),
             });
         }
         validate_optional_header_value(field, Some(endpoint))?;
     }
+    if reporting_endpoints_header_value(endpoints).is_none() && !endpoints.is_empty() {
+        return Err(ConfigError::InvalidResponseHeaderValue { field });
+    }
     Ok(())
 }
 
 pub fn reporting_endpoints_header_value(endpoints: &BTreeMap<String, String>) -> Option<String> {
     if endpoints.is_empty() {
         return None;
     }
-    Some(
-        endpoints
-            .iter()
-            .map(|(name, endpoint)| format!("{name}=\"{endpoint}\""))
-            .collect::<Vec<_>>()
-            .join(", "),
-    )
+    let mut serialized = String::new();
+    for (name, endpoint) in endpoints {
+        if !valid_structured_field_key(name)
+            || !endpoint.starts_with("https://")
+            || !valid_http_endpoint_url(endpoint)
+        {
+            return None;
+        }
+        let endpoint = serialize_sf_string(endpoint)?;
+        let separator_bytes = usize::from(!serialized.is_empty()) * 2;
+        let additional_bytes = separator_bytes
+            .checked_add(name.len())?
+            .checked_add(1)?
+            .checked_add(endpoint.len())?;
+        if serialized.len().checked_add(additional_bytes)? > MAX_REPORTING_ENDPOINTS_HEADER_BYTES {
+            return None;
+        }
+        if !serialized.is_empty() {
+            serialized.push_str(", ");
+        }
+        serialized.push_str(name);
+        serialized.push('=');
+        serialized.push_str(&endpoint);
+    }
+    Some(serialized)
+}
+
+fn valid_structured_field_key(name: &str) -> bool {
+    if name.len() > MAX_REPORTING_ENDPOINT_NAME_BYTES {
+        return false;
+    }
+    let mut bytes = name.bytes();
+    matches!(bytes.next(), Some(b'a'..=b'z' | b'*'))
+        && bytes.all(|byte| {
+            matches!(
+                byte,
+                b'a'..=b'z' | b'0'..=b'9' | b'_' | b'-' | b'.' | b'*'
+            )
+        })
+}
+
+fn serialize_sf_string(value: &str) -> Option<String> {
+    if !value.is_ascii() || value.bytes().any(|byte| !(0x20..=0x7e).contains(&byte)) {
+        return None;
+    }
+    let escaped_bytes = value
+        .bytes()
+        .filter(|byte| matches!(byte, b'"' | b'\\'))
+        .count();
+    let capacity = value.len().checked_add(escaped_bytes)?.checked_add(2)?;
+    let mut serialized = String::with_capacity(capacity);
+    serialized.push('"');
+    for character in value.chars() {
+        if matches!(character, '"' | '\\') {
+            serialized.push('\\');
+        }
+        serialized.push(character);
+    }
+    serialized.push('"');
+    Some(serialized)
 }
 
 fn default_true() -> bool {

crates/fluxheim-config/src/config_tests_headers_response.rs

@@ -1,5 +1,6 @@
 use super::super::*;
 use crate::ResponseHeaderRewriteRuleConfig;
+use crate::config_header_hardening::reporting_endpoints_header_value;
 use crate::{ResponseHardeningProfile, ResponsePermissionsPolicyConfig};
 
 #[test]
@@ -368,3 +369,70 @@ fn rejects_invalid_reporting_endpoint_url() {
         })
     );
 }
+
+#[test]
+fn rejects_invalid_reporting_endpoint_dictionary_members() {
+    for name in ["CSP", "1csp", "csp+production"] {
+        let mut config = Config::default();
+        config.headers.response.reporting_endpoints.insert(
+            name.to_owned(),
+            "https://reports.example.test/csp".to_owned(),
+        );
+        assert!(matches!(
+            config.validate(),
+            Err(ConfigError::InvalidHeaderValue {
+                field: "headers.response.reporting_endpoints",
+                ..
+            })
+        ));
+    }
+
+    for endpoint in [
+        "http://reports.example.test/csp",
+        "https://reports.example.test/csp-\u{00e5}",
+    ] {
+        let mut config = Config::default();
+        config
+            .headers
+            .response
+            .reporting_endpoints
+            .insert("csp".to_owned(), endpoint.to_owned());
+        assert!(matches!(
+            config.validate(),
+            Err(ConfigError::InvalidHeaderValue {
+                field: "headers.response.reporting_endpoints",
+                ..
+            })
+        ));
+    }
+}
+
+#[test]
+fn serializes_reporting_endpoints_as_bounded_structured_fields() {
+    let endpoints = std::collections::BTreeMap::from([
+        (
+            "csp".to_owned(),
+            "https://reports.example.test/csp\"primary".to_owned(),
+        ),
+        (
+            "network-errors".to_owned(),
+            "https://reports.example.test/network\\errors".to_owned(),
+        ),
+    ]);
+    assert_eq!(
+        reporting_endpoints_header_value(&endpoints).as_deref(),
+        Some(
+            "csp=\"https://reports.example.test/csp\\\"primary\", network-errors=\"https://reports.example.test/network\\\\errors\""
+        )
+    );
+
+    let oversized = (0..9)
+        .map(|index| {
+            (
+                format!("endpoint-{index}"),
+                format!("https://reports.example.test/{}", "a".repeat(2000)),
+            )
+        })
+        .collect();
+    assert_eq!(reporting_endpoints_header_value(&oversized), None);
+}

crates/fluxheim-server/src/native_http1_cors.rs

@@ -123,9 +123,15 @@ impl NativeCorsPolicy {
     }
 
     pub(crate) fn response_origin(&self, request: &NativeHttp1Request) -> Option<String> {
-        self.enabled
-            .then(|| self.allowed_origin(request).map(str::to_owned))
-            .flatten()
+        if !self.enabled
+            || !self
+                .allow_methods
+                .iter()
+                .any(|allowed| allowed.eq_ignore_ascii_case(&request.method))
+        {
+            return None;
+        }
+        self.allowed_origin(request).map(str::to_owned)
     }
 
     pub(crate) fn apply_response_origin(

crates/fluxheim-server/src/native_http1_proxy_tests/header_policy.rs

@@ -5,7 +5,7 @@ use tokio::net::{TcpListener, TcpStream};
 
 use crate::{DownstreamHttp1Policy, NativeHttp1Proxy, NativeHttp1Upstream};
 
-use super::{proxy_listener_for, upstream};
+use super::{counting_upstream, proxy_listener_for, upstream};
 
 #[tokio::test]
 async fn native_proxy_applies_header_policy() {
@@ -260,6 +260,48 @@ async fn native_route_proxy_handles_validated_cors_preflight_and_actual_request(
     assert!(!response.contains("access-control-max-age: 86400\r\n"));
 }
 
+#[tokio::test]
+async fn native_route_proxy_enforces_cors_methods_on_actual_responses() {
+    let (upstream, requests) = counting_upstream("ok", 2).await;
+    let mut config = fluxheim_config::Config::default();
+    config.proxy.upstreams = vec![upstream.to_string()];
+    config.headers.cors = fluxheim_config::CorsPolicyConfig {
+        enabled: true,
+        allow_origins: vec!["https://app.example.test".to_owned()],
+        allow_methods: vec!["POST".to_owned()],
+        allow_headers: Vec::new(),
+        expose_headers: Vec::new(),
+        allow_credentials: true,
+        max_age_secs: None,
+    };
+    config.headers.validate().unwrap();
+    let proxy = crate::NativeHttp1RouteProxy::from_root_config(
+        &config,
+        DownstreamHttp1Policy::default(),
+        0,
+    )
+    .unwrap();
+    let proxy = route_proxy_listener(proxy).await;
+
+    let get = downstream_request(
+        proxy,
+        "GET /resource HTTP/1.1\r\nHost: proxy.test\r\nOrigin: https://app.example.test\r\nConnection: close\r\n\r\n",
+    )
+    .await;
+    let post = downstream_request(
+        proxy,
+        "POST /resource HTTP/1.1\r\nHost: proxy.test\r\nOrigin: https://app.example.test\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+    )
+    .await;
+
+    assert!(get.starts_with("HTTP/1.1 200 OK\r\n"));
+    assert!(!get.contains("access-control-allow-origin:"));
+    assert!(!get.contains("access-control-allow-credentials:"));
+    assert!(post.contains("access-control-allow-origin: https://app.example.test\r\n"));
+    assert!(post.contains("access-control-allow-credentials: true\r\n"));
+    assert_eq!(requests.load(std::sync::atomic::Ordering::Acquire), 2);
+}
+
 async fn downstream_request(proxy: std::net::SocketAddr, request: &str) -> String {
     let mut client = TcpStream::connect(proxy).await.unwrap();
     client.write_all(request.as_bytes()).await.unwrap();

docs/config-reference.md

@@ -1227,7 +1227,8 @@ profile = "deny-sensitive"
 csp = "https://reports.example.com/csp"
 ```
 
-Reporting endpoints are limited to 16 validated HTTP(S) URLs. Use report-only
+Reporting endpoints are limited to 16 HTTPS URLs, use lowercase RFC 9651
+dictionary keys, and have a bounded aggregate serialized size. Use report-only
 CSP before enforcement, keep the endpoint on trusted infrastructure, and bound
 its retention and ingestion independently. The generic response mutation layer
 remains available for deliberately site-specific policies. For example,
@@ -1271,7 +1272,11 @@ locally with `204`; denied preflights receive `403` and do not reach the origin.
 Fluxheim owns the resulting CORS headers, replaces unsafe upstream values, and
 manages `Vary: Origin`, `Vary: Access-Control-Request-Method`, and
 `Vary: Access-Control-Request-Headers`. Response compression separately manages
-`Vary: Accept-Encoding`.
+`Vary: Accept-Encoding`. Actual responses receive CORS authorization headers
+only when both the request origin and request method are allowed. CORS controls
+whether browser JavaScript may read a response; it is not CSRF protection and
+must never replace route access policy, authentication, authorization, or
+same-site cookie controls.
 
 Generated rate-limit and concurrency-limit responses include
 `Retry-After: 1`. Temporary PHP-FPM and ACME blocking-work saturation responses

packaging/rpm/fluxheim.spec

@@ -163,6 +163,7 @@ fi
   handling while preserving operator-selected response policy.
 - Add opt-in response-hardening profiles, typed modern browser controls,
   validated request-aware CORS, automatic Vary, and bounded Retry-After.
+- Enforce actual-response CORS methods and strict Reporting-Endpoints encoding.
 
 * Sun Jul 12 2026 Fluxheim Maintainers <1921261+eldryoth@users.noreply.github.com> - 1.7.9-1
 - Start documented and runnable Wasm migration-example parity work.

release-notes/RELEASE_NOTES_1.7.10.md

@@ -41,6 +41,8 @@ keeping the typed policy ABI constrained.
   cookies named `Domain` or `Path` are not mistaken for attributes.
 - Preserve closing quotes and trailing syntax while rewriting quoted exact-
   origin `Refresh` URLs.
+- Enforce CORS method allowlists on actual responses and serialize bounded
+  Reporting-Endpoints dictionaries with strict keys and HTTPS collectors.
 
 ## Security