From 67f748ba76e14209e1c2d00192797f0899cec19b Mon Sep 17 00:00:00 2001 From: Nguyen Huy Hoang <24520554@gm.uit.edu.vn> Date: Thu, 26 Mar 2026 23:22:49 +0700 Subject: [PATCH] fix: header-based sso trusts client-supplied identity without proxy origin check Signed-off-by: Nguyen Huy Hoang <181364121+huyhoang171106@users.noreply.github.com> --- backend/user/src/remote_user_auth.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/backend/user/src/remote_user_auth.py b/backend/user/src/remote_user_auth.py index 0567db14..617eb0ef 100644 --- a/backend/user/src/remote_user_auth.py +++ b/backend/user/src/remote_user_auth.py @@ -8,3 +8,16 @@ class HttpRemoteUserMiddleware(PersistentRemoteUserMiddleware): """ header = settings.TA_AUTH_PROXY_USERNAME_HEADER + + def process_request(self, request): + """Only trust remote-user header from configured proxy IPs.""" + trusted_proxy_ips = getattr(settings, "TA_TRUSTED_PROXY_IPS", []) + if isinstance(trusted_proxy_ips, str): + trusted_proxy_ips = [ + ip.strip() for ip in trusted_proxy_ips.split(",") if ip.strip() + ] + + if request.META.get("REMOTE_ADDR") not in trusted_proxy_ips: + request.META.pop(self.header, None) + + return super().process_request(request)