xvkong233 3ad985f36e fix(nat): scrub dashboard-issued credentials from all accepted token channels ...

The initial selective strip covered only the Authorization header, but the
dashboard also accepts its JWT via the ?token= query parameter and the
nz-jwt cookie (jwt.go TokenLookup channels). A dashboard credential arriving
through those channels would still reach a NAT backend.

Apply the same classify-then-strip rule to all three channels at NAT
ingress: values verified as dashboard-issued are removed, foreign values
are preserved byte-for-byte. Adds a ServeNAT flow test exercising the live
classifier and a wiring test pinning the gate injection in main().

2026-10-01 11:17:45 +00:00

..

admin-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

controller

fix(nat): scrub dashboard-issued credentials from all accepted token channels

2026-10-01 11:17:45 +00:00

rpc

fix(nat): scrub dashboard-issued credentials from all accepted token channels

2026-10-01 11:17:45 +00:00

user-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

dashboard_credential_wiring_test.go

fix(nat): scrub dashboard-issued credentials from all accepted token channels

2026-10-01 11:17:45 +00:00

dashboard_listener_default.go

feat(agentcompat): add dashboard listener hooks

2026-07-20 04:33:38 +00:00

dashboard_listener_integration_test.go

feat(agentcompat): add dashboard listener hooks

2026-07-20 04:33:38 +00:00

dashboard_listener_integration.go

feat(agentcompat): add dashboard listener hooks

2026-07-20 04:33:38 +00:00

dashboard_listener_test.go

feat(agentcompat): add dashboard listener hooks

2026-07-20 04:33:38 +00:00

dashboard_listener.go

feat(agentcompat): add dashboard listener hooks

2026-07-20 04:33:38 +00:00

main.go

fix(nat): scrub dashboard-issued credentials from all accepted token channels

2026-10-01 11:17:45 +00:00