Repository navigation
fix: require a shared secret on auth internal routes - #1389
Conversation
The /internal/* gate treated a missing cf-connecting-ip plus x-uploads-internal: 1 as proof the caller was the API. That fails open if an edge request arrives without the IP header. Compare x-uploads-internal-key to AUTH_INTERNAL_KEY instead. The API still sends the old header so an API-first deploy keeps working.
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one): 2
🚫 Excluded labels (none allowed): 1
Please check the settings in the CodeRabbit UI or the
 |
|
In plain terms
Auth routes that only the API should call were guarded by a header anyone can send, plus the hope that Cloudflare always attaches a client IP. That fails open if an edge request shows up without the IP header. Those routes now require a shared secret that is already installed on both workers.
What it does / what it is not
uploads-authaccepts/internal/*only whenx-uploads-internal-keymatchesAUTH_INTERNAL_KEY. A missing or wrong key is still a 404.uploads-apisends that key on every service-binding call to those routes. It also still sendsx-uploads-internal: 1, so an API deploy that lands first keeps working against the current auth worker.BILLING_INTERNAL_KEYstays the billing secret.AUTH_INTERNAL_KEYis missing. The value is already set onuploads-apianduploads-auth.How to try it
Nothing to run in the CLI. After this merges, Workers Builds deploys both workers. Org lookups, invites, and the admin paths that call
/internal/*should keep working. If auth deploys first, those calls 404 until the API deploy lands.Technical notes
The compare hashes both sides and then checks the digests, so it runs under plain-Node vitest. The API helper is
authInternalHeaders. Public proxies do not forward the key.Test plan
pnpm --filter @uploads/auth exec vitest run src/internal.test.ts src/index.test.ts src/internal-routes.test.tspnpm --filter @uploads/api exec vitest runon the internal callers, header helper, admin UI, webhook queue, usage alerts, CLI upgrade, and weekly digest tests (248 tests)pnpm --filter @uploads/auth typecheckandpnpm --filter @uploads/api typecheck/internal/*still succeeds