diff options
| author | omnom62 <omnom62@outlook.com> | 2026-09-12 07:22:16 +1000 |
|---|---|---|
| committer | omnom62 <omnom62@outlook.com> | 2026-09-12 07:22:16 +1000 |
| commit | fa46c294c8239534472a140293125864c0ea857d (patch) | |
| tree | 21c40a95c8868246fcd9caba8914686257767ba2 /data/templates/https/nginx.default.j2 | |
| parent | 438463db0d290e58cb733893478cdb4537d922f8 (diff) | |
| download | vyos-1x-fa46c294c8239534472a140293125864c0ea857d.tar.gz vyos-1x-fa46c294c8239534472a140293125864c0ea857d.zip | |
https: T8989: fix X-Client-Verify header passthrough auth bypass
Always set proxy_set_header X-Client-Verify unconditionally so a
client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS
authentication when mTLS is not configured.
When mTLS is disabled, nginx sets X-Client-Verify to empty string
which correctly fails the == 'SUCCESS' check in auth_required.
Fixes: GHSA-4w7q-wwx4-6973
Diffstat (limited to 'data/templates/https/nginx.default.j2')
| -rw-r--r-- | data/templates/https/nginx.default.j2 | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/data/templates/https/nginx.default.j2 b/data/templates/https/nginx.default.j2 index 0f1a79ad7..49134d5ab 100644 --- a/data/templates/https/nginx.default.j2 +++ b/data/templates/https/nginx.default.j2 @@ -62,10 +62,8 @@ server { proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600; proxy_buffering off; -{% if certificates.mtls_ca_path is vyos_defined %} proxy_set_header X-Client-Verify $ssl_client_verify; proxy_set_header X-Client-DN $ssl_client_s_dn; -{% endif %} {% else %} return 503; {% endif %} |