riotpiao-poimen/homelab-frontend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(identity): inject X-Forwarded-User headers after JWT validation #15

Merged
rock merged 1 commits from feat/p3.4-identity-headers into main 2026-09-08 23:08:42 +00:00
Conversation 0 Commits 1 Files Changed 3
+324
rock commented 2026-09-08 22:59:58 +00:00
Owner
Copy Link
Copy Source

Closes homelab#9 (P3.4)

Changes

  • New internal/identity package: header injection + anti-spoofing
  • proxy.go: strip spoofed headers on all requests, inject identity after JWT validation

Headers

Header Source When
X-Forwarded-User sub claim Always after JWT
X-Forwarded-Roles roles or permissions claim Always after JWT
X-Acting-Service azp claim Only when azp != sub
X-Auth-Verified literal "true" Always after JWT

Tests

13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence.

Closes homelab#9 (P3.4) ## Changes - New `internal/identity` package: header injection + anti-spoofing - `proxy.go`: strip spoofed headers on all requests, inject identity after JWT validation ## Headers | Header | Source | When | |--------|--------|------| | X-Forwarded-User | sub claim | Always after JWT | | X-Forwarded-Roles | roles or permissions claim | Always after JWT | | X-Acting-Service | azp claim | Only when azp != sub | | X-Auth-Verified | literal "true" | Always after JWT | ## Tests 13 tests, 93.9% coverage. Covers: spoofing, service accounts, human users, empty claims, nil values, wildcard, mixed types, precedence.
rock added 1 commit 2026-09-08 23:00:01 +00:00
feat(identity): inject X-Forwarded-User headers after JWT validation
CI / CI (pull_request) Successful in 4m0s
Details
8c668fe69a 
Strip spoofed identity headers from inbound requests, inject
authenticated identity (sub, roles, azp) after JWT validation.
93.9% test coverage, 13 tests.

Closes homelab#9

Co-authored-by: poimen <[email protected]>
rock merged commit 6f7b850193 into main 2026-09-08 23:08:42 +00:00
rock deleted branch feat/p3.4-identity-headers 2026-09-08 23:08:47 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code
 priority/high
Must have
 priority/low
Nice to have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
poimen rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab-frontend#15