sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-13 17:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[proxy] Enforce per-target HTTP access actions (#8115)

Browse Source 
Apply target access before service authentication: inherit, bypass, or block. Keep route selection and auth decisions on the same snapshot; reject stale or unavailable required middleware.

Validation: full auth/proxy race tests and scoped lint passed. Runtime regression tests remain with this layer.
This commit is contained in:
Maycon Santos
2026-10-12 12:31:57 +02:00
committed by GitHub
parent a7a2575bad
commit 1161616c02
16 changed files with 2692 additions and 640 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/README.md
+37
View File
@@ -33,6 +33,43 @@ If any authentication methods are registered for the Host domain, then the Proxy
If the user is successfully authenticated, their request will be forwarded through to the Proxy to be proxied to the relevant Peer.
Successful authentication does not guarantee a successful forwarding of the request as there may be failures behind the Proxy, such as with Peer connectivity or the underlying resource.
### Target access control
HTTP targets have an optional `access_action` setting, configured under
**Edit Target → Optional Settings → Access** in the dashboard:
| Value | Behavior |
| --- | --- |
| `inherit` | Use the service's authentication settings. This is the default. A service without authentication remains public. |
| `bypass` | Forward anonymously without prompting for service authentication. |
| `block` | Return HTTP 403, including for authenticated users. |
The longest matching Location prefix selects both the target and its access
action. Prefixes are literal and case-sensitive: `/api` also matches `/apiv2`,
while `/api/` only matches requests beginning with `/api/` and does not match
`/api` itself. Wildcards and regular expressions are not supported. A blocked
request or failed authentication never falls through to another target. Disabling
or deleting a target removes its rule, so a less-specific target may then match.
Service IP, country, and reputation restrictions still apply to bypassed paths.
Bypass is unavailable for private services and Agent Network targets. Bypassed
requests have no NetBird user identity; configured header-auth credentials,
NetBird session cookies, and client-supplied NetBird identity headers are still
removed before forwarding. Custom upstream headers remain target settings, so
consider their effect when making a target public.
Services using target access overrides reject ambiguous request paths, including
encoded separators and traversal segments, before forwarding. Path rewriting
continues to use the selected Location prefix after access checks.
Upgrade all proxies before using target access actions. Older proxies ignore
these actions and continue applying the service's authentication settings.
API updates that omit an existing Location's
`access_action` preserve its setting; send `"access_action": "inherit"` explicitly
to restore service authentication. Requests omitting all access actions cannot
remove or rename a controlled Location; use an updated client and explicitly
include the intended actions when changing those targets.
## TLS
Due to the authentication provided, the Proxy uses HTTPS for its endpoint, even if the underlying service is HTTP.