newklei 2dbcdefbbe

forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545) ...

When using copy_headers in a forward_auth block, client-supplied headers with
the same names were not being removed before being forwarded to the backend.

This happens because PR #6608 added a MatchNot guard that skips the Set
operation when the auth service does not return a given header. That guard
prevents setting headers to empty strings, which is the correct behavior,
but it also means a client can send X-User-Id: admin in their request and
if the auth service validates the token without returning X-User-Id, Caddy
skips the Set and the client value passes through unchanged to the backend.

The fix adds an unconditional delete route for each copy_headers entry,
placed just before the existing conditional set route. The delete always runs
regardless of what the auth service returns. The conditional set still only
runs when the auth service provides that header.

The end result is:
  - Client-supplied headers are always removed
  - When the auth service returns the header, the backend gets that value
  - When the auth service does not return the header, the backend sees nothing

Existing behavior is unchanged for any deployment where the auth service
returns all of the configured copy_headers entries.

Fixes GHSA-7r4p-vjf4-gxv4

2026-03-03 23:30:49 -05:00

..

caddyfile_adapt

forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)

2026-03-03 23:30:49 -05:00

testdata

fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)

2026-03-03 13:16:21 -05:00

acme_test.go

logging: Ensure slog error level logs don't print stack traces (#7512)

2026-03-03 14:44:42 -07:00

acmeserver_test.go

chore: Add nolints to work around haywire linters (#7493)

2026-02-17 16:52:54 -07:00

autohttps_test.go

http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)

2026-02-21 21:42:40 -05:00

caddyfile_adapt_test.go

httpcaddyfile: Validates TLS DNS challenge options (#7099)

2025-06-30 23:58:16 +00:00

caddyfile_test.go

httpcaddyfile: Prevent error handler from overriding sub-handler matchers (#6999)

2025-06-06 11:46:39 -06:00

forwardauth_test.go

forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)

2026-03-03 23:30:49 -05:00

h2listener_test.go

caddyhttp: wrap accepted connection to suppress tls.ConnectionState (#7247)

2025-10-16 03:13:40 +00:00

handler_test.go

staticresp: Use the evaluated response body for sniffing JSON content-type (#6249)

2024-04-18 20:31:00 +00:00

intercept_test.go

intercept: fix http.intercept.header.* placeholder (#6429)

2024-07-03 08:43:13 -06:00

leafcertloaders_test.go

ci: fix the integration test TestLeafCertLoaders (#6149)

2024-03-06 02:09:13 +03:00

listener_test.go

use math/rand/v2 instead of math/rand (#7413)

2026-02-11 09:15:51 -07:00

map_test.go

ci: fix integration tests (#5079)

2022-09-24 19:00:55 +00:00

mockdns_test.go

httpcaddyfile: Add missing DNS challenge check for acme_dns (#7270)

2025-10-03 14:05:46 -06:00

pki_test.go

admin: Fix tests locally, properly isolate storage (#7486)

2026-02-17 13:14:06 -07:00

proxyprotocol_test.go

proxyproto: Generated test coverage (#7540)

2026-03-03 15:08:09 -07:00

reverseproxy_test.go

reverseproxy: Fix health_port being ignored in health checks (#7533)

2026-03-03 13:10:54 -05:00

sni_test.go

filesystem: Globally declared filesystems, fs directive (#5833)

2024-01-13 20:12:43 +00:00

stream_test.go

chore: upgrade .golangci.yml and workflow to v2 (#6924)

2025-06-03 02:24:32 +03:00