riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects 1 Releases Wiki Activity

P3.4: Inject X-Forwarded-User identity headers after JWT validation #9

New Issue
Open
opened 2026-09-08 04:42:00 +00:00 by rock · 0 comments
rock commented 2026-09-08 04:42:00 +00:00
Owner
Copy Link
Copy Source

Summary

After JWT validation, gateway injects identity headers so downstream gets audit trail without parsing JWTs.

Code repo: rock/homelab-frontend — internal/proxy/proxy.go

Headers

X-Forwarded-User: rock              # sub claim
X-Forwarded-Roles: llm:inference    # roles/permissions claim
X-Acting-Service: portfolio-agent   # azp claim (service accounts only)
X-Auth-Verified: true               # gateway validated JWT

Acceptance Criteria

  • Headers injected after successful JWT validation
  • Incoming X-Forwarded-User / X-Auth-Verified STRIPPED from client request (anti-spoofing)
  • Unauthenticated requests do NOT get these headers
  • Unit tests: injection, stripping, edge cases

Security contract

Downstream MUST only accept traffic from gateway (NetworkPolicy enforced).
Downstream trusts X-Auth-Verified: true header — if absent, request is unauthenticated.

Review checklist

  • Anti-spoofing: incoming headers stripped before injection
  • Wildcard "*" passed as literal, not expanded
  • Empty claims handled (no empty header values)
## Summary After JWT validation, gateway injects identity headers so downstream gets audit trail without parsing JWTs. **Code repo:** `rock/homelab-frontend` — `internal/proxy/proxy.go` ## Headers ``` X-Forwarded-User: rock # sub claim X-Forwarded-Roles: llm:inference # roles/permissions claim X-Acting-Service: portfolio-agent # azp claim (service accounts only) X-Auth-Verified: true # gateway validated JWT ``` ## Acceptance Criteria - [ ] Headers injected after successful JWT validation - [ ] Incoming `X-Forwarded-User` / `X-Auth-Verified` STRIPPED from client request (anti-spoofing) - [ ] Unauthenticated requests do NOT get these headers - [ ] Unit tests: injection, stripping, edge cases ## Security contract Downstream MUST only accept traffic from gateway (NetworkPolicy enforced). Downstream trusts `X-Auth-Verified: true` header — if absent, request is unauthenticated. ## Review checklist - [ ] Anti-spoofing: incoming headers stripped before injection - [ ] Wildcard "*" passed as literal, not expanded - [ ] Empty claims handled (no empty header values)
rock added this to the Phase 3: OAuth2 Token Exchange & Identity Propagation milestone 2026-09-08 04:42:00 +00:00
rock added the area/autharea/gatewaytype/featurestatus/todopriority/high labels 2026-09-08 04:42:01 +00:00
rock self-assigned this 2026-09-08 04:42:02 +00:00
rock added this to the API-GW OAuth project 2026-09-08 04:43:55 +00:00
rock moved this to Todo in API-GW OAuth on 2026-09-08 04:44:40 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/auth
Authentication & authorization
 area/authentik
Authentik OIDC provider config
 area/downstream
Downstream service changes
 area/gateway
API gateway code (homelab-frontend)
 priority/high
Must have
 priority/medium
Should have
 status/blocked
Blocked by dependency
 status/done
Completed
 status/in-progress
Currently being worked on
 status/review
Ready for review
 status/todo
Not started
 type/docs
Documentation
 type/feature
New feature
 type/infra
Infrastructure change
No labels area/auth area/gateway priority/high status/todo type/feature
Milestone
No items
No Milestone Phase 3: OAuth2 Token Exchange & Identity Propagation
Projects
Clear projects
No projects
API-GW OAuth
Todo
Assignees
Clear assignees
poimen rock (Rock)
No Assignees rock
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: riotpiao-poimen/homelab#9