riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(identity): inject X-Forwarded-User headers after JWT validation
CI / CI (pull_request) Successful in 4m0s
Details

Browse Source 
Strip spoofed identity headers from inbound requests, inject
authenticated identity (sub, roles, azp) after JWT validation.
93.9% test coverage, 13 tests.

Closes homelab#9

Co-authored-by: poimen <[email protected]>
This commit is contained in:
Admin Bot
2026-09-08 15:59:39 -07:00
co-authored by poimen
parent 5dd76f3b49
commit 8c668fe69a
3 changed files with 324 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/proxy/proxy.go
+8
View File
@@ -15,6 +15,7 @@ import (
"forgejo.riotpiao.com/rock/homelab-frontend/internal/auth"
"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
"forgejo.riotpiao.com/rock/homelab-frontend/internal/identity"
"forgejo.riotpiao.com/rock/homelab-frontend/internal/logging"
"forgejo.riotpiao.com/rock/homelab-frontend/internal/tracing"
)
@@ -303,6 +304,10 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
// Strip spoofed identity headers from all inbound requests.
// Must happen before any routing — even unauthenticated paths.
identity.StripIncoming(r)
// JWT Authentication for /v1/* endpoints
if h.jwtValidator != nil && strings.HasPrefix(r.URL.Path, "/v1/") {
authHeader := r.Header.Get("Authorization")
@@ -331,6 +336,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
return
}
// Inject identity headers for downstream services
identity.Inject(r, claims)
// Check required capability if configured
if h.config.Auth.RequiredCapability != "" {
if !h.jwtValidator.CheckPermissions(claims, h.config.Auth.RequiredCapability, "*") {