meshcore-hub

mirror of https://github.com/ipnet-mesh/meshcore-hub.git synced 2026-07-27 12:03:19 +02:00

Files

T

Louis King 7b44049e6e fix(web): sanitize X-User-Name header to prevent 502 on registration

When an IdP name claim contains trailing whitespace (e.g. 'Matt '), every
proxied API request failed with 502 'Illegal header value' because httpx
enforces RFC 7230 which forbids leading/trailing OWS in header values.

Defense in depth:
- strip_userinfo() trims the IdP name at ingress (oidc.py)
- _sanitize_header_value() removes CTL/DEL chars at both header-injection
  sites (API proxy + auth-callback bootstrap) in app.py
- update_profile() trims user-supplied names in PUT handler

X-User-Name is informational only (seeds non-unique UserProfile.name);
identity/auth are keyed on X-User-Id and X-User-Roles, so sanitization is
safe.

2026-07-04 20:06:04 +01:00

__init__.py

Implement Phase 1: Foundation for MeshCore Hub

2025-12-02 23:10:53 +00:00

conftest.py

fix(web): sanitize X-User-Name header to prevent 502 on registration

2026-07-04 20:06:04 +01:00

test_advertisements.py

feat: add esbuild bundling with content-hash cache busting

2026-05-05 18:27:41 +01:00

test_app.py

fix(web): sanitize X-User-Name header to prevent 502 on registration