mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-11-04 16:40:21 +00:00
xvkong233
40240ed02b
Since 2640b86 (v2.2.11, 2026-07-20) the NAT ingress deleted the entire
Authorization header, breaking self-hosted apps behind the tunnel that
authenticate with their own Bearer tokens (e.g. the Qinglong panel login
loop).
Strip only credentials issued by this dashboard and forward foreign ones:
- controller.IsDashboardCredential classifies an Authorization value as
dashboard-issued via a signature-only JWT parser derived from the auth
middleware (same key, HS256 pinned, claims validation deliberately
skipped so an expired panel token is still recognized and kept out of
the tunnel) or an api_tokens lookup for PAT-shaped values. Unknown PATs,
foreign signatures, other schemes and missing values pass through. When
classification cannot complete (parser not ready, DB nil or error) the
verdict fails closed (strip) and the log carries a fixed reason only,
never credential content.
- Both NAT capability variants (default, and agent-compat legacy /
invalid-capability / post-consume paths) replace the unconditional
Del("Authorization") with stripDashboardCredential. The rpc package
receives the classifier through SetNATDashboardCredentialGate, the same
injection pattern as SetMCPKillSwitchObserver; an unwired gate keeps the
historical strip-everything behavior.
Tests: controller classification semantics (panel JWT, expired panel JWT
and panel PAT stripped; foreign-signed JWT, unknown nzp_ token, random
strings, non-Bearer schemes and missing header pass through; parser
unavailable, DB nil and DB error fail closed with credential-free logs)
plus rpc unit and flow coverage for both variants (dashboard credentials
never reach the forwarded bytes; foreign and missing Authorization are
forwarded untouched).
Compatibility: no API, database or frontend changes; NAT backends that do
not use Authorization behave exactly as before.
42 lines
1.8 KiB
Go
42 lines
1.8 KiB
Go
package rpc
|
|
|
|
import "net/http"
|
|
|
|
// natDashboardCredentialGate classifies an Authorization header value as a
|
|
// credential issued by this dashboard (panel-signed JWT or panel API token).
|
|
// main() injects controller.IsDashboardCredential; the setter keeps the rpc
|
|
// package free of a dependency on the controller package, the same pattern as
|
|
// SetReceiptGateListener and SetMCPKillSwitchObserver.
|
|
var natDashboardCredentialGate func(authz string) bool
|
|
|
|
// SetNATDashboardCredentialGate wires the dashboard-credential classifier used
|
|
// by the NAT ingress. Passing nil restores the fail-closed default in
|
|
// stripDashboardCredential.
|
|
func SetNATDashboardCredentialGate(fn func(authz string) bool) {
|
|
natDashboardCredentialGate = fn
|
|
}
|
|
|
|
// stripDashboardCredential removes the Authorization header when it carries a
|
|
// credential issued by this dashboard (panel-signed JWT or panel API token).
|
|
// Such credentials authenticate the dashboard itself and must never become
|
|
// origin credentials for the NAT backend. Foreign credentials are forwarded
|
|
// untouched: the NAT backend may authenticate with credentials of its own, and
|
|
// this dashboard must not make policy for them.
|
|
func stripDashboardCredential(request *http.Request) {
|
|
if natDashboardCredentialGate == nil {
|
|
// Gate not wired (early startup or tests): fail closed and keep the
|
|
// historical behavior of stripping every Authorization header.
|
|
request.Header.Del("Authorization")
|
|
return
|
|
}
|
|
// A multi-valued Authorization header is malformed traffic, but any
|
|
// dashboard-issued value in it must still not survive into the tunnel, so
|
|
// the whole header is dropped when one is recognized.
|
|
for _, value := range request.Header.Values("Authorization") {
|
|
if natDashboardCredentialGate(value) {
|
|
request.Header.Del("Authorization")
|
|
return
|
|
}
|
|
}
|
|
}
|