Peter Steinberger
7d8aeaaf06
fix(gateway): pin paired reconnect metadata for node policy
2026-02-26 14:11:04 +01:00
Peter Steinberger
0cc3e8137c
refactor(gateway): centralize trusted-proxy control-ui bypass policy
2026-02-26 02:26:52 +01:00
Peter Steinberger
ec45c317f5
fix(gateway): block trusted-proxy control-ui node bypass
2026-02-26 01:54:19 +01:00
Peter Steinberger
20c2db2103
refactor(gateway): split browser auth hardening paths
2026-02-26 01:37:00 +01:00
Peter Steinberger
c736f11a16
fix(gateway): harden browser websocket auth chain
2026-02-26 01:22:49 +01:00
Peter Steinberger
8d1481cb4a
fix(gateway): require pairing for unpaired operator device auth
2026-02-26 00:52:50 +01:00
SidQin-cyber
20523b918a
fix(gateway): allow trusted-proxy control-ui auth to skip device pairing
...
Control UI connections authenticated via gateway.auth.mode=trusted-proxy were
still forced through device pairing because pairing bypass only considered
shared token/password auth (sharedAuthOk). In trusted-proxy deployments,
this produced persistent "pairing required" failures despite valid trusted
proxy headers.
Treat authenticated trusted-proxy control-ui connections as pairing-bypass
eligible and allow missing device identity in that mode.
Fixes #25293
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-24 14:17:54 +00:00
Peter Steinberger
223d7dc23d
feat(gateway)!: require explicit non-loopback control-ui origins
2026-02-24 01:57:11 +00:00
Vincent Koc
7fb69b7cd2
Gateway: stop repeated unauthorized WS request floods per connection ( #24294 )
...
* Gateway WS: add unauthorized flood guard primitive
* Gateway WS: close repeated unauthorized post-handshake request floods
* Gateway WS: test unauthorized flood guard behavior
* Changelog: note gateway WS unauthorized flood guard hardening
* Update CHANGELOG.md
2026-02-23 09:58:47 -05:00
Peter Steinberger
9165bd7f37
fix(gateway): auto-approve loopback scope upgrades
...
Co-authored-by: Marcus Widing <245375637+widingmarcus-cyber@users.noreply.github.com>
2026-02-22 22:11:50 +01:00
Peter Steinberger
bbdfba5694
fix: harden connect auth flow and exec policy diagnostics
2026-02-22 20:22:00 +01:00
Peter Steinberger
0c1f491a02
fix(gateway): clarify pairing and node auth guidance
2026-02-22 19:50:29 +01:00
Peter Steinberger
b13bba9c35
fix(gateway): skip operator pairing on valid shared auth
2026-02-22 19:25:50 +01:00
Peter Steinberger
66529c7aa5
refactor(gateway): unify auth credential resolution
2026-02-22 18:23:13 +01:00
Peter Steinberger
f14ebd743c
refactor(security): unify local-host and tailnet CIDR checks
2026-02-22 17:20:27 +01:00
Peter Steinberger
d116bcfb14
refactor(runtime): consolidate followup, gateway, and provider dedupe paths
2026-02-22 14:08:51 +00:00
Peter Steinberger
2c6dd84718
fix(gateway): remove hello-ok host and commit fields
2026-02-22 10:17:36 +01:00
Peter Steinberger
8887f41d7d
refactor(gateway)!: remove legacy v1 device-auth handshake
2026-02-22 09:27:03 +01:00
Marcus Widing
fa4e4efd92
fix(gateway): restore localhost Control UI pairing when allowInsecureAuth is set ( #22996 )
...
* fix(gateway): allow localhost Control UI without device identity when allowInsecureAuth is set
* fix(gateway): pass isLocalClient to evaluateMissingDeviceIdentity
* test: add regression tests for localhost Control UI pairing
* fix(gateway): require pairing for legacy metadata upgrades
* test(gateway): fix legacy metadata e2e ws typing
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-22 00:04:52 +01:00
Peter Steinberger
51149fcaf1
refactor(gateway): extract connect and role policy logic
2026-02-21 19:47:22 +01:00
Peter Steinberger
ddcb2d79b1
fix(gateway): block node role when device identity is missing
2026-02-21 19:34:13 +01:00
Peter Steinberger
be7f825006
refactor(gateway): harden proxy client ip resolution
2026-02-21 13:36:23 +01:00
Peter Steinberger
36a0df423d
refactor(gateway): make ws and http auth surfaces explicit
2026-02-21 13:33:09 +01:00
Peter Steinberger
14b0d2b816
refactor: harden control-ui auth flow and add insecure-flag audit summary
2026-02-21 13:18:23 +01:00
Peter Steinberger
356d61aacf
fix(gateway): scope tailscale tokenless auth to websocket
2026-02-21 13:03:13 +01:00
Peter Steinberger
99048dbec2
fix(gateway): align insecure-auth toggle messaging
2026-02-21 12:57:22 +01:00
Coy Geek
40a292619e
fix: Control UI Insecure Auth Bypass Allows Token-Only Auth Over HTTP ( #20684 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: ad9be4b4d65698785ad7ea9ad650f54d16c89c4a
Co-authored-by: coygeek <65363919+coygeek@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
2026-02-20 17:34:34 +00:00
Shakker
525d6e0671
Gateway: align pairing scope checks for read access
2026-02-20 05:12:05 +00:00
Josh Avant
29ad0736f4
fix(gateway): tolerate legacy paired metadata in ws upgrade checks ( #21447 )
...
Fixes the pairing required regression from #21236 for legacy paired devices
created without roles/scopes metadata. Detects legacy paired metadata shape
and skips upgrade enforcement while backfilling metadata in place on reconnect.
Co-authored-by: Josh Avant <830519+joshavant@users.noreply.github.com>
Co-authored-by: Val Alexander <68980965+BunsDev@users.noreply.github.com>
2026-02-19 17:45:56 -06:00
Peter Steinberger
c45f3c5b00
fix(gateway): harden canvas auth with session capabilities
2026-02-19 15:51:22 +01:00
Peter Steinberger
d900d5efbd
style: normalize ws message handler import ordering
2026-02-19 13:51:53 +00:00
Peter Steinberger
0bda0202fd
fix(security): require explicit approval for device access upgrades
2026-02-19 14:49:09 +01:00
Gustavo Madeira Santana
07fdceb5fd
refactor: centralize presence routing and version precedence coverage ( #19609 )
...
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 10d9df5263f5e14712fa4f9f62b7a686dc55e6ae
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras
2026-02-18 00:02:51 -05:00
Peter Steinberger
adac9cb67f
refactor: dedupe gateway and scheduler test scaffolding
2026-02-18 04:04:14 +00:00
Peter Steinberger
b8b43175c5
style: align formatting with oxfmt 0.33
2026-02-18 01:34:35 +00:00
Peter Steinberger
31f9be126c
style: run oxfmt and fix gate failures
2026-02-18 01:29:02 +00:00
cpojer
d0cb8c19b2
chore: wtf.
2026-02-17 13:36:48 +09:00
Sebastian
ed11e93cf2
chore(format)
2026-02-16 23:20:16 -05:00
cpojer
90ef2d6bdf
chore: Update formatting.
2026-02-17 09:18:40 +09:00
Vignesh Natarajan
eed02a2b57
fix (security/gateway): preserve control-ui scopes in bypass mode
2026-02-15 19:12:06 -08:00
Peter Steinberger
1843bcf1db
refactor(gateway): share host header parsing
2026-02-15 16:15:53 +00:00
Peter Steinberger
7323953ab0
refactor(gateway): share device signature reject path
2026-02-15 16:04:37 +00:00
Peter Steinberger
35c0e66ed0
fix(security): harden hooks module loading
2026-02-14 15:03:27 +01:00
Peter Steinberger
a79c2de956
refactor(gateway): extract ws auth message helpers
2026-02-13 19:08:37 +00:00
Harald Buerbaumer
30b6eccae5
feat(gateway): add auth rate-limiting & brute-force protection ( #15035 )
...
* feat(gateway): add auth rate-limiting & brute-force protection
Add a per-IP sliding-window rate limiter to Gateway authentication
endpoints (HTTP, WebSocket upgrade, and WS message-level auth).
When gateway.auth.rateLimit is configured, failed auth attempts are
tracked per client IP. Once the threshold is exceeded within the
sliding window, further attempts are blocked with HTTP 429 + Retry-After
until the lockout period expires. Loopback addresses are exempt by
default so local CLI sessions are never locked out.
The limiter is only created when explicitly configured (undefined
otherwise), keeping the feature fully opt-in and backward-compatible.
* fix(gateway): isolate auth rate-limit scopes and normalize 429 responses
---------
Co-authored-by: buerbaumer <buerbaumer@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
2026-02-13 15:32:38 +01:00
Peter Steinberger
cfd112952e
fix(gateway): default-deny missing connect scopes
2026-02-11 12:04:30 +01:00
Coy Geek
717129f7f9
fix: silence unused hook token url param ( #9436 )
...
* fix: Gateway authentication token exposed in URL query parameters
* fix: silence unused hook token url param
* fix: remove gateway auth tokens from URLs (#9436 ) (thanks @coygeek)
* test: fix Windows path separators in audit test (#9436 )
---------
Co-authored-by: George Pickett <gpickett00@gmail.com>
2026-02-05 18:08:29 -08:00
George Pickett
a459e237e8
fix(gateway): require auth for canvas host and a2ui assets ( #9518 ) (thanks @coygeek)
2026-02-05 16:37:58 -08:00
Peter Steinberger
66d8117d44
fix: harden control ui framing + ws origin
2026-02-03 16:00:57 -08:00
Peter Steinberger
fe81b1d712
fix(gateway): require shared auth before device bypass
2026-02-02 16:56:38 -08:00
