PR Custody

fix(auth): trust only vercel edge client ip header for allowlists

@kaavee315checks n/achecks…codex/fix-api-key-ip-allowlist-vulnerability → master2 files · +19 −124updated 1w ago

▸Description · 1 noise

A security review found API-key allowlist checks used spoofable forwarding headers (e.g. cf-connecting-ip, x-forwarded-for) as the source of truth, allowing an attacker to bypass IP restrictions by supplying forged headers.
The goal is to make authorization decisions fail-closed by using only an edge-managed, non-client-controllable header for client IP extraction.

Tighten getClientIpFromHeaders in apps/apollo/src/server/context/utils/get_client_ip.ts so it only accepts x-vercel-forwarded-for (via REQ_HEADERS.X_VERCEL_FORWARDED_FOR) and returns UNKNOWN_CLIENT_IP for all other header combinations.
Remove trust of cf-connecting-ip, true-client-ip, x-forwarded-for, and x-real-ip for authorization-time IP extraction to prevent header spoofing.
Update unit tests in apps/apollo/src/server/context/utils/__tests__/get_client_ip.unit.test.ts to assert the new trust model, including tests that other forwarding headers are ignored when x-vercel-forwarded-for is absent.

Attempted to run the updated unit test file src/server/context/utils/__tests__/get_client_ip.unit.test.ts using the workspace test runner, which produced engine/override warnings but did not execute the tests in this environment.
Running pnpm vitest for the test file failed due to missing runtime environment variables and missing Doppler binary, so tests could not be executed here.
The change is intentionally minimal and focused on authorization input hardening; the updated tests are included in the PR to be executed in CI or a developer environment with required secrets where they should pass.

▸ 1 bot/status comment hidden

@github-actions[bot]1w ago

Based on git blame analysis of 2 file(s):

Contributor	Contribution	Files
Zen	97%	2
abir-taheer	3%	1

Based on git history, Zen or abir-taheer would be good reviewer(s) for this PR.

🤖 Based on git blame with recency weighting (recent edits count more).

loading diff…