security(phase-1): trust proxy, zip-slip guard, header allowlist, admin + billing warnings
1.1 — Trust proxy: app.set('trust proxy', 1) in gateway and self-hosted hub so express-rate-limit reads the real client IP from X-Forwarded-For behind Netlify CDN / load balancers instead of the CDN's address.
1.2 — Zip-slip protection: validate every AdmZip entry resolves within the extract directory before calling extractAllTo. Malicious archives with ../ traversal or absolute paths now return HTTP 400. Applied to both hub/server.mjs (self-hosted import) and hub/bridge/server.mjs.
1.3 — Default-admin startup warning: hub/server.mjs logs a yellow [SECURITY] warning at startup when NODE_ENV=production and roleMap.size === 0, alerting operators that all users have admin access until roles are set.
1.4 — Header allowlist: replace ...req.headers spread in proxyToCanister and proxyTo (hub/gateway/server.mjs) with an explicit PROXY_HEADER_ALLOWLIST (content-type, accept, accept-language, accept-encoding). proxyTo also forwards authorization and x-vault-id. Prevents cookies, x-forwarded-for, x-test-user, origin, referer, and other sensitive client headers from leaking to the canister or bridge.
1.5 — Billing enforcement warning: gateway startup emits a yellow [SECURITY] warning when CANISTER_URL is set but BILLING_ENFORCE is not true, so operators know billing limits are unenforced before public launch.
Tests: 36 new unit tests in test/phase1-security.test.mjs; 1306 total passing. Docs: docs/SECURITY-AUDIT-PLAN.md Phase 1 marked ✅ COMPLETE.
0 comments
muse hub commit comment sha256:2080386d8be29b7eede3bf6b0dbd9e054bee00703a576e34069dd98384f8be14 --body "your comment"
No comments yet. Be the first to start the discussion.