feat(ap4): defend forwarded identity headers

e2e/pattern4.mjs

@@ -97,6 +97,20 @@ try {
   assert.deepEqual(storage.sessionStorage, []);
   assert.equal(storage.readableCookies.includes("AP4_SESSION"), false);
 
+  const spoofAttempt = await page.evaluate(async () => {
+    const response = await fetch("/", {
+      headers: {
+        "X-Auth-Request-User": "spoofed-admin",
+        "X-Auth-Request-Email": "spoofed-admin@example.test",
+        "X-Internal-Auth-Token": "attacker-controlled-token",
+      },
+    });
+    return { status: response.status, body: await response.json() };
+  });
+  assert.equal(spoofAttempt.status, 200);
+  assert.equal(spoofAttempt.body.user, edgeIdentity.user);
+  assert.notEqual(spoofAttempt.body.user, "spoofed-admin");
+
   const externalAuthSubrequest = await fetch(`${edgeBaseUrl}/oauth2/auth`);
   assert.equal(externalAuthSubrequest.status, 404);
 
@@ -111,17 +125,13 @@ try {
     "oauth2-proxy must not be published on the host",
   );
 
-  const missingHeader = await fetch("http://localhost:8081/edge/me");
-  assert.equal(missingHeader.status, 401);
-  const directSpoof = await fetch("http://localhost:8081/edge/me", {
-    headers: { "X-Auth-Request-User": "spoofed-admin" },
-  });
-  assert.equal(directSpoof.status, 200);
-  const spoofedIdentity = await directSpoof.json();
-  assert.equal(spoofedIdentity.user, "spoofed-admin");
+  await assert.rejects(
+    fetch("http://localhost:8081/edge/me"),
+    "backend must not be published on the host",
+  );
 
   console.log(
-    "pattern4 nginx auth_request verified: internal subrequest, browser redirect, API 401, forwarded identity",
+    "pattern4 hardened edge verified: auth_request, no backend publish, spoofed headers overwritten",
   );
 } finally {
   await browser.close();