decentraland / social-service-ea / 36679390447

91%

main: 91%

Pull #501

github

fix: reject non-string auth header values in the websocket auth frame

Review follow-up for SOCIAL-SERVICE-EA-3H (https://decentraland.sentry.io/issues/7713056598/).
It also covers SOCIAL-SERVICE-EA-3J (https://decentraland.sentry.io/issues/7713296423/).

An x-identity-timestamp sent as a JSON number passes the middleware's timestamp and expiry
checks, then crashes createPayload with "TypeError: firstOf(...)?.toLowerCase is not a
function" (3J). That throw is reported as a server error from a frame the client built.
parseAuthChainHeaders now rejects, with the same 400, any x-identity-* header whose value is
not a string or an array of strings. It also rejects a top-level array. Fields that are not
auth headers are left untouched, as before.

Also updates the ws_auth_errors and isExpectedAuthRejection docs and one test title to match
the new behaviour, and names the headers type once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2614 of 3015 branches covered (86.7%)

Branch coverage included in aggregate %.

14 of 14 new or added lines in 1 file covered. (100.0%)

6261 of 6714 relevant lines covered (93.25%)

93.77 hits per line