harden: refuse a token over non-loopback http on every config-layer request #605

New issue

Closed

opened 2026-09-23 15:22:15 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-23 15:22:15 +00:00

Owner

What

madtea refuses to send the API token to a non-loopback http:// URL on its main request paths (RequireSecureScheme). The environment rung of GetCredentialsWithSource does not run that check, and auth whoami passes its result to VerifyServerAuth. So auth whoami with an http:// MADTEA_URL sends the token in cleartext. The refusal rule itself lives only in a code comment, with no decision record.

Fix

doAuthedRequest, which attaches the token for every internal/config request, runs RequireSecureScheme before it sets the header. Loopback http and token-less requests still go out.
The refusal text named gitea.url, a key madtea does not read. It now names MADTEA_URL and madtea.url.
A decision record states the rule: no token over non-loopback http, no opt-out, loopback exempt.

Acceptance

A token-bearing config request to a non-loopback http:// URL is refused before any request is sent.
Token-less requests, https, and loopback http still go out.
The decision record exists and cites this issue.
The gate is green.

## What madtea refuses to send the API token to a non-loopback `http://` URL on its main request paths (`RequireSecureScheme`). The environment rung of `GetCredentialsWithSource` does not run that check, and `auth whoami` passes its result to `VerifyServerAuth`. So `auth whoami` with an `http://` `MADTEA_URL` sends the token in cleartext. The refusal rule itself lives only in a code comment, with no decision record. ## Fix - `doAuthedRequest`, which attaches the token for every `internal/config` request, runs `RequireSecureScheme` before it sets the header. Loopback `http` and token-less requests still go out. - The refusal text named `gitea.url`, a key madtea does not read. It now names `MADTEA_URL` and `madtea.url`. - A decision record states the rule: no token over non-loopback http, no opt-out, loopback exempt. ## Acceptance - A token-bearing config request to a non-loopback `http://` URL is refused before any request is sent. - Token-less requests, `https`, and loopback `http` still go out. - The decision record exists and cites this issue. - The gate is green.

hexajon added the

severity/low

security

labels

2026-09-23 15:22:15 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-23 15:28:27 +00:00

fix(config): refuse a token over non-loopback http on every config request #606

hexajon referenced this issue from a commit

2026-09-23 15:28:27 +00:00

fix(config): refuse a token over non-loopback http on every config request

hexajon closed this issue