mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekayandHanzo Dev
782da26c75
This list exists so a service can drop client-supplied identity headers before
its own auth re-injects them. Five were missing from it, and they are the five
that matter most:
X-User-Permissions an authorization bypass
X-User-IsGlobalAdmin an authorization bypass
X-Billing-Account-Id the account the request is charged to
X-User-Owner the home org
X-Project-Id the sub-scope
The gateway strips all five. This copy did not, so any service sitting behind
this middleware and NOT behind the gateway trusted whatever the client sent —
and that is exactly the case this middleware exists for.
The two lists live in modules that do not import each other, which is why they
drifted. A test now pins every name the gateway strips; it fails with
"X-Billing-Account-Id survived as forged-by-the-client" if one goes missing
again. One list in one place is the real fix and is a separate change.
Co-authored-by: Hanzo Dev <[email protected]>