diff options
| author | omnom62 <omnom62@outlook.com> | 2026-09-12 07:22:16 +1000 |
|---|---|---|
| committer | omnom62 <omnom62@outlook.com> | 2026-09-12 07:22:16 +1000 |
| commit | fa46c294c8239534472a140293125864c0ea857d (patch) | |
| tree | 21c40a95c8868246fcd9caba8914686257767ba2 /src/migration-scripts/webproxy | |
| parent | 438463db0d290e58cb733893478cdb4537d922f8 (diff) | |
| download | vyos-1x-fa46c294c8239534472a140293125864c0ea857d.tar.gz vyos-1x-fa46c294c8239534472a140293125864c0ea857d.zip | |
https: T8989: fix X-Client-Verify header passthrough auth bypass
Always set proxy_set_header X-Client-Verify unconditionally so a
client-supplied X-Client-Verify: SUCCESS header cannot bypass mTLS
authentication when mTLS is not configured.
When mTLS is disabled, nginx sets X-Client-Verify to empty string
which correctly fails the == 'SUCCESS' check in auth_required.
Fixes: GHSA-4w7q-wwx4-6973
Diffstat (limited to 'src/migration-scripts/webproxy')
0 files changed, 0 insertions, 0 deletions