3bdae4bcc5
Hardens the IP allowlist in require_auth against the two bypasses filed in #3. 1. Bypass via missing X-Forwarded-For (no IP to check, allowlist skipped). 2. Spoofing via attacker-controlled X-Forwarded-For (header trusted unconditionally). Resolves both by deriving the client IP from the socket peer (ConnectInfo<SocketAddr>) and only honoring X-Forwarded-For when the immediate peer is in a new security.trusted_proxies allowlist (default empty = strict). Fails closed with 403 forbidden_ip when a non-empty allowlist is configured and the client IP cannot be determined. Empty ip_whitelist continues to mean allow all (preserved for dev installs). 27 pm-auth tests pass (12 new resolver + 8 new middleware + 7 existing). Spec: tasks/ip-allowlist-spec.md.
33 lines
840 B
TOML
33 lines
840 B
TOML
[package]
|
|
name = "pm-auth"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
authors.workspace = true
|
|
license.workspace = true
|
|
|
|
[dependencies]
|
|
pm-core = { path = "../pm-core" }
|
|
tokio = { workspace = true }
|
|
axum = { workspace = true }
|
|
axum-extra = { workspace = true }
|
|
sqlx = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true }
|
|
chrono = { workspace = true }
|
|
argon2 = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
rand = { workspace = true }
|
|
totp-rs = { workspace = true }
|
|
base64 = { workspace = true }
|
|
hex = { workspace = true }
|
|
ipnet = { workspace = true }
|
|
parking_lot = "0.12"
|
|
sha2 = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tower = { version = "0.5", features = ["util"] }
|