Harden SSRF defenses and admin auth for safe shared deploys - #1
Closed
pandeyvishwas51-oss wants to merge 1 commit into
Closed
Harden SSRF defenses and admin auth for safe shared deploys#1pandeyvishwas51-oss wants to merge 1 commit into
pandeyvishwas51-oss wants to merge 1 commit into
Conversation
Block private/metadata probe targets at registration, dispatch, and execution; require admin auth on all /admin routes; fix readiness 503 and unsafe CORS defaults so shared deploys fail closed safely. Co-authored-by: Cursor <cursoragent@cursor.com>
Member
Author
|
Closing — will reopen from the correct account (arpita-at) after local review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
169.254.169.254). Validation runs at admin registration, scheduler dispatch, and probe execution (defense in depth), and URL host must match the registered domain./admin/*routes now go throughrequire_admin()with constant-time key compare. MissingADMIN_API_KEYcan fail closed viaALLOW_UNAUTHENTICATED_ADMIN=false(recommended for prod)./readyreturns 503 when DB/Redis are down (K8s-ready); CORS no longer pairs*with credentials; probe-node listing uses RedisSCANinstead of blockingKEYS.See docs/SECURITY.md for the full threat model and recommended settings.
Why this matters for users
Without these guards, anyone who could hit an open admin API (default when
ADMIN_API_KEYis empty) could registerhttp://169.254.169.254/...orhttp://127.0.0.1:...and force the Playwright fleet to scrape internal services / cloud IMDS.Test plan
pytest tests/ -v --ignore=tests/integration— 61 passedfile://, DNS-rebinding mockhttp://127.0.0.1/even if a bad Redis job is injectedADMIN_API_KEY=test+ALLOW_UNAUTHENTICATED_ADMIN=false, confirm/api/v1/admin/targetsrequires headerPOST /admin/targetswithurl=http://127.0.0.1/→ 400/ready→ 200; stop Redis → 503Made with Cursor