feat(ap4): defend forwarded identity headers

2026-07-25 14:59:47 +09:00
parent 452aa4808a
commit 2d58dea5e1
11 changed files with 116 additions and 34 deletions
@@ -1,4 +1,4 @@
 FROM nginx:1.29-alpine

-COPY nginx.conf /etc/nginx/conf.d/default.conf
+COPY default.conf.template /etc/nginx/templates/default.conf.template
 COPY index.html /usr/share/nginx/html/index.html
@@ -46,6 +46,7 @@ server {
        proxy_pass http://app:8081/edge/me;
        proxy_set_header X-Auth-Request-User $auth_user;
        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
    }

    location / {
@@ -60,6 +61,7 @@ server {
        proxy_pass http://app:8081/edge/me;
        proxy_set_header X-Auth-Request-User $auth_user;
        proxy_set_header X-Auth-Request-Email $auth_email;
+        proxy_set_header X-Internal-Auth-Token "${INTERNAL_AUTH_TOKEN}";
    }

    location @oauth2_signin {