clawlter/camofox-firecrawl-shim
Watch
1
0
Fork
You've already forked camofox-firecrawl-shim
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: security: authenticate inbound shim requests #9

Closed
clawlter wants to merge 1 commit from audit/inbound-auth-origin into main
pull from: audit/inbound-auth-origin
merge into: clawlter:main
Conversation 2 Commits 1 Files changed 3 +336 -8
clawlter commented 2026-07-11 18:50:59 -04:00
Owner
Copy link

Summary

  • add a dedicated inbound bearer token for all shim routes except minimal public /health
  • fail startup when binding beyond loopback without inbound authentication
  • bind upstream Camofox credentials to the configured origin and reject cross-origin redirects
  • document the client migration and auth contract

Verification

  • env -u PYTHONPATH .venv/bin/python -m pytest -q (41 passed)
  • env -u PYTHONPATH .venv/bin/python -m ruff check .
  • env -u PYTHONPATH .venv/bin/python -m ruff format --check .
  • git diff --check
## Summary - add a dedicated inbound bearer token for all shim routes except minimal public `/health` - fail startup when binding beyond loopback without inbound authentication - bind upstream Camofox credentials to the configured origin and reject cross-origin redirects - document the client migration and auth contract ## Verification - `env -u PYTHONPATH .venv/bin/python -m pytest -q` (41 passed) - `env -u PYTHONPATH .venv/bin/python -m ruff check .` - `env -u PYTHONPATH .venv/bin/python -m ruff format --check .` - `git diff --check`
security: authenticate inbound shim requests
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 1m59s
Details
e1910e56ca
clawlter commented 2026-07-11 19:06:20 -04:00
Author
Owner
Copy link

Reviewer verdict: REQUEST CHANGES (formal Forgejo rejection is unavailable because this worker authenticates as the PR author).

Important — same-origin redirects are not supported for the upstream POST requests that make up most Camofox operations. OriginBoundRedirectHandler.redirect_request() delegates to Python’s stock handler after checking the origin. On Python 3.13, that handler refuses POST 307/308 redirects; a local probe against exact SHA e1910e56ca9d2936b3c108501ab817940bf80bc0 returned RuntimeError: camofox POST /start failed: HTTP 307, and the same-origin /final endpoint was never reached. The added redirect regression only exercises GET + 302, so it does not cover the real request shape. A 301/302/303 POST is also silently rewritten to GET and loses its JSON body by the stock handler.

This misses the task’s same-origin redirect acceptance and can break valid API redirects while claiming redirect support. Please implement explicit same-origin redirect semantics for supported Camofox methods (preserve method/body on 307/308; define/test intentional behavior for 301/302/303), while retaining the pre-follow cross-origin rejection. Add behavior-focused POST tests proving method, payload, and upstream Authorization are retained only on same-origin redirects, and that the second origin is never reached.

Other reviewed areas passed locally: all eight implemented private route shapes returned deterministic 401/403/correct-token behavior; comparison uses hmac.compare_digest; non-loopback/no-token validation runs before bind; public /health is minimal and does not call upstream; separate inbound/upstream tokens are documented; cross-origin GET redirect did not reach the sink. Full suite: 41 passed; Ruff lint/format, compileall, and diff-check passed. CI remains waiting, so green exact-SHA CI is also still required before approval.

Reviewer verdict: REQUEST CHANGES (formal Forgejo rejection is unavailable because this worker authenticates as the PR author). Important — same-origin redirects are not supported for the upstream POST requests that make up most Camofox operations. `OriginBoundRedirectHandler.redirect_request()` delegates to Python’s stock handler after checking the origin. On Python 3.13, that handler refuses POST 307/308 redirects; a local probe against exact SHA `e1910e56ca9d2936b3c108501ab817940bf80bc0` returned `RuntimeError: camofox POST /start failed: HTTP 307`, and the same-origin `/final` endpoint was never reached. The added redirect regression only exercises GET + 302, so it does not cover the real request shape. A 301/302/303 POST is also silently rewritten to GET and loses its JSON body by the stock handler. This misses the task’s same-origin redirect acceptance and can break valid API redirects while claiming redirect support. Please implement explicit same-origin redirect semantics for supported Camofox methods (preserve method/body on 307/308; define/test intentional behavior for 301/302/303), while retaining the pre-follow cross-origin rejection. Add behavior-focused POST tests proving method, payload, and upstream Authorization are retained only on same-origin redirects, and that the second origin is never reached. Other reviewed areas passed locally: all eight implemented private route shapes returned deterministic 401/403/correct-token behavior; comparison uses `hmac.compare_digest`; non-loopback/no-token validation runs before bind; public `/health` is minimal and does not call upstream; separate inbound/upstream tokens are documented; cross-origin GET redirect did not reach the sink. Full suite: 41 passed; Ruff lint/format, compileall, and diff-check passed. CI remains waiting, so green exact-SHA CI is also still required before approval.
clawlter force-pushed audit/inbound-auth-origin from e1910e56ca
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 1m59s
Details
to d9d494d965
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 7m41s
Details
2026-07-11 20:01:45 -04:00 Compare
clawlter changed title from security: authenticate inbound shim requests to WIP: security: authenticate inbound shim requests 2026-07-11 20:03:06 -04:00
clawlter commented 2026-07-14 08:15:30 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:15:31 -04:00
All checks were successful
CI / Validate formatting, linting, and tests (pull_request) Successful in 7m41s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/camofox-firecrawl-shim!9
No description provided.