merge(r2): PLAN-R2-07 UI/Management/Security

2026-07-13 11:08:10 -04:00
parent b7f5470666 2751a6dba9
commit 774e3918db
26 changed files with 852 additions and 92 deletions
@@ -337,6 +337,18 @@ try
        }

        // Middleware pipeline
+
+        // Trusted-proxy forwarded headers (arch-review R2 N2): behind Traefik every client
+        // shares the proxy's IP, collapsing the LoginThrottle's {username}|{ip} keys onto
+        // one address (per-IP isolation gone + cheap username-lockout DoS). When enabled,
+        // X-Forwarded-For from the CONFIGURED proxies only is honored. MUST run first —
+        // everything downstream keys on Connection.RemoteIpAddress.
+        var forwardedOptions = builder.Configuration
+            .GetSection(ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSecurityOptions.SectionName)
+            .Get<ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSecurityOptions>() ?? new();
+        if (ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSetup.Build(forwardedOptions) is { } fho)
+            app.UseForwardedHeaders(fho);
+
        app.UseWebSockets();
        app.UseRouting();
        app.UseAuthentication();