fix(security): trusted-proxy ForwardedHeaders so LoginThrottle keys on the real client IP (plan R2-07 T2)

2026-07-13 10:38:41 -04:00
parent e1a692016e
commit b532a1e30e
3 changed files with 112 additions and 0 deletions
@@ -337,6 +337,18 @@ try
        }

        // Middleware pipeline
+
+        // Trusted-proxy forwarded headers (arch-review R2 N2): behind Traefik every client
+        // shares the proxy's IP, collapsing the LoginThrottle's {username}|{ip} keys onto
+        // one address (per-IP isolation gone + cheap username-lockout DoS). When enabled,
+        // X-Forwarded-For from the CONFIGURED proxies only is honored. MUST run first —
+        // everything downstream keys on Connection.RemoteIpAddress.
+        var forwardedOptions = builder.Configuration
+            .GetSection(ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSecurityOptions.SectionName)
+            .Get<ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSecurityOptions>() ?? new();
+        if (ZB.MOM.WW.ScadaBridge.Security.ForwardedHeadersSetup.Build(forwardedOptions) is { } fho)
+            app.UseForwardedHeaders(fho);
+
        app.UseWebSockets();
        app.UseRouting();
        app.UseAuthentication();