rays/ipodderx-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Proxy sign-in trusts a header any container on Tower can send #41

New Issue
Closed
opened 2026-09-19 08:16:14 -07:00 by rays · 1 comment
rays commented 2026-09-19 08:16:14 -07:00
Owner
Copy Link

The Cloudflare Access sign-in believed Cf-Access-Authenticated-User-Email from any address in trusted_proxies. On Tower that is the Docker gateway (192.168.16.1), so any container on the host could send the header and be anyone, the admin included. Cloudflare's signed Cf-Access-Jwt-Assertion was not checked. Listed as a known gap in CLAUDE.md and docs/sso.md.

The Cloudflare Access sign-in believed `Cf-Access-Authenticated-User-Email` from any address in `trusted_proxies`. On Tower that is the Docker gateway (192.168.16.1), so any container on the host could send the header and be anyone, the admin included. Cloudflare's signed `Cf-Access-Jwt-Assertion` was not checked. Listed as a known gap in CLAUDE.md and docs/sso.md.
rays added the bug label 2026-09-19 08:16:14 -07:00
rays commented 2026-09-19 08:16:14 -07:00
Author
Owner
Copy Link

Fixed in c1187a7, released in 0.8.3. With [web] access_team and access_aud set, a proxied request must also carry a Cf-Access-Jwt-Assertion that verifies against Cloudflare's keys (RS256, this app's audience, the team's issuer, unexpired), and the name comes from its email claim. Turned on in production on 2026-09-19 (access_team rays-sdf1.cloudflareaccess.com). Checked: a container sending only the email header gets 401, where it used to be signed in as the admin; signing in at ipodderx.sdf1.net through Authentik still works. docs/sso.md updated in b81d44c.

Fixed in c1187a7, released in 0.8.3. With `[web] access_team` and `access_aud` set, a proxied request must also carry a `Cf-Access-Jwt-Assertion` that verifies against Cloudflare's keys (RS256, this app's audience, the team's issuer, unexpired), and the name comes from its email claim. Turned on in production on 2026-09-19 (access_team rays-sdf1.cloudflareaccess.com). Checked: a container sending only the email header gets 401, where it used to be signed in as the admin; signing in at ipodderx.sdf1.net through Authentik still works. docs/sso.md updated in b81d44c.
rays closed this issue 2026-09-19 08:16:15 -07:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
rays
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: rays/ipodderx-rs#41
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?