fix(security): sanitize WWW-Authenticate realm URL and prevent header injection via X-Forwarded headers

commit: 795aa513cafe650be0302b71c367e7f120ef953d
author: bnema · 8mo ago · 2026-02-01 14:32 UTC
parent: d044953
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +30 -10

M internal/adapters/in/http/middleware/auth.go +30 -10


@@ -87,6 +87,21 @@ func isAuthenticated(r *http.Request, expectedUsername, expectedPassword string,
87	87		return authenticated
88	88		}
89	89
	90	+	// sanitizeHeaderValue removes characters that could enable header injection.
	91	+	// Only allows alphanumeric, dots, hyphens, colons, and square brackets
	92	+	// (sufficient for host:port and IPv6 addresses).
	93	+	func sanitizeHeaderValue(value string) string {
	94	+	var b strings.Builder
	95	+	b.Grow(len(value))
	96	+	for _, r := range value {
	97	+	if (r >= 'a' && r <= 'z') \|\| (r >= 'A' && r <= 'Z') \|\| (r >= '0' && r <= '9') \|\|
	98	+	r == '.' \|\| r == '-' \|\| r == ':' \|\| r == '[' \|\| r == ']' {
	99	+	b.WriteRune(r)
	100	+	}
	101	+	}
	102	+	return b.String()
	103	+	}
	104	+
90	105		// redactUsername partially redacts a username for logging.
91	106		// Shows first and last character with asterisks in between.
92	107		// SECURITY: Prevents full username exposure in logs.

@@ -417,19 +432,24 @@ func sendUnauthorized(w http.ResponseWriter, authType domain.AuthType, host stri
417	432
418	433		switch authType {
419	434		case domain.AuthTypeToken:
420		-	// For token auth, indicate the token server endpoint
421		-	// Use X-Forwarded-Host if behind proxy, otherwise use Host header
422		-	realmHost := r.Header.Get("X-Forwarded-Host")
423		-	if realmHost == "" {
424		-	realmHost = host
425		-	}
426		-	// Detect scheme: prioritize X-Forwarded-Proto (set by reverse proxies like Cloudflare)
	435	+	// For token auth, indicate the token server endpoint.
	436	+	// SECURITY: Only use X-Forwarded-Host/Proto from trusted sources.
	437	+	// The Host header from the request is used as the default.
	438	+	// X-Forwarded-Host is NOT trusted here because this middleware doesn't
	439	+	// have access to trusted proxy configuration, and an attacker could
	440	+	// inject a malicious realm URL to phish for credentials.
	441	+	realmHost := host
	442	+
	443	+	// Detect scheme from TLS state only (not from headers that can be spoofed)
427	444		scheme := "http"
428		-	if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
429		-	scheme = proto
430		-	} else if r.TLS != nil {
	445	+	if r.TLS != nil {
431	446		scheme = "https"
432	447		}
	448	+
	449	+	// SECURITY: Sanitize the host to prevent header injection.
	450	+	// Remove any characters that could break the WWW-Authenticate header format.
	451	+	realmHost = sanitizeHeaderValue(realmHost)
	452	+
433	453		realm := scheme + "://" + realmHost + "/auth/token"
434	454		w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`)
435	455		default:

 	return authenticated
 }
+// sanitizeHeaderValue removes characters that could enable header injection.
+// Only allows alphanumeric, dots, hyphens, colons, and square brackets
+// (sufficient for host:port and IPv6 addresses).
+func sanitizeHeaderValue(value string) string {
+	var b strings.Builder
+	b.Grow(len(value))
+	for _, r := range value {
+		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') ||
+			r == '.' || r == '-' || r == ':' || r == '[' || r == ']' {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
 // redactUsername partially redacts a username for logging.
 // Shows first and last character with asterisks in between.
 // SECURITY: Prevents full username exposure in logs.
 	switch authType {
 	case domain.AuthTypeToken:
-		// For token auth, indicate the token server endpoint
+		// For token auth, indicate the token server endpoint.
-		// Use X-Forwarded-Host if behind proxy, otherwise use Host header
+		// SECURITY: Only use X-Forwarded-Host/Proto from trusted sources.
-		realmHost := r.Header.Get("X-Forwarded-Host")
+		// The Host header from the request is used as the default.
-		if realmHost == "" {
+		// X-Forwarded-Host is NOT trusted here because this middleware doesn't
-			realmHost = host
+		// have access to trusted proxy configuration, and an attacker could
-		}
+		// inject a malicious realm URL to phish for credentials.
-		// Detect scheme: prioritize X-Forwarded-Proto (set by reverse proxies like Cloudflare)
+		realmHost := host
+		// Detect scheme from TLS state only (not from headers that can be spoofed)
 		scheme := "http"
-		if proto := r.Header.Get("X-Forwarded-Proto"); proto != "" {
+		if r.TLS != nil {
-			scheme = proto
-		} else if r.TLS != nil {
 			scheme = "https"
 		}
+		// SECURITY: Sanitize the host to prevent header injection.
+		// Remove any characters that could break the WWW-Authenticate header format.
+		realmHost = sanitizeHeaderValue(realmHost)
 		realm := scheme + "://" + realmHost + "/auth/token"
 		w.Header().Set("WWW-Authenticate", `Bearer realm="`+realm+`",service="gordon-registry"`)
 	default: