nucleus-core-ts 0.9.726 → 0.9.727

package/dist/src/Client/Proxy/httpProxy.js

@@ -328,23 +328,15 @@ export function createHttpProxyHandler(config) {
             headers.delete('x-forwarded-for');
             headers.delete('x-real-ip');
         }
-        // SECURITY (same trust-boundary rationale as the IP strip above): the proxy is the
-        // authority for identity. STRIP every client-supplied identity header so a caller can
-        // never forward `x-user-id: <victim>` / `x-user-roles: godmin` / `x-user-claims: …`
-        // to a trusting backend. Any legitimate values are re-set below ONLY from a verified
-        // source (target.headers config, or injectUserIdFromJwt). Defense-in-depth: the nucleus
-        // edge (ElysiaPlugin onRequest) also strips these, but a non-nucleus backend behind this
-        // proxy would otherwise be impersonatable.
-        for (const h of [
-            'x-user-id',
-            'x-user-role',
-            'x-user-roles',
-            'x-user-claims',
-            'x-user-email',
-            'x-auth-type'
-        ]){
-            headers.delete(h);
-        }
+        // NOTE: this proxy deliberately does NOT strip inbound x-user-* identity headers. A
+        // legitimate TRUSTED upstream (e.g. the Vorion portal server.ts) VERIFIES the session and
+        // sets x-user-id / x-user-role / x-user-roles / x-user-claims from the verified cookie
+        // BEFORE handing the request to this handler — stripping them here would drop the caller's
+        // roles/claims and break the backend. Anti-spoofing therefore belongs at the entry edge
+        // that first sees the client (server.ts strips+re-sets from verified cookies; the nucleus
+        // ElysiaPlugin onRequest strips+re-derives from the verified JWT). Only x-user-id is
+        // re-set below when injectUserIdFromJwt is configured (an explicit opt-in for a bare
+        // backend); the other identity headers pass through from the trusted upstream unchanged.
         if (target.headers) {
             for (const [key, value] of Object.entries(target.headers)){
                 headers.set(key, value);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.726",
+	"version": "0.9.727",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",