stacklok / toolhive / 28378137776

68%

Build Type

push

github

Committed by web-flow

Commit Message

Strip client Authorization on upstreamswap custom header (#5661)

The upstreamswap "custom" header strategy injected the upstream IdP
token into a custom header but left the client's original Authorization
header (the ToolHive-issued JWT) in place, forwarding it to the backend.
That token is minted for the proxy, not the upstream, so passing it
through is credential passthrough (#5504). The "replace" strategy avoids
this implicitly because it overwrites Authorization; the strip-auth
middleware from #4168 only runs on the DisableUpstreamTokenInjection
path, so it never covered this case.

Strip Authorization in the custom injector after setting the custom
header, matching the "replace" behavior. When the custom header name is
itself Authorization (case-insensitive), the Set already replaced the
JWT with the upstream token, so the strip is skipped.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

80 existing lines in 5 files now uncovered.

69750 of 103513 relevant lines covered (67.38%)

63.92 hits per line