Repository navigation
Require a local Host for loopback trust (DNS rebinding) - #24
Open
Deep-Sixed wants to merge 5 commits into
Open
Deep-Sixed wants to merge 5 commits into
Deep-Sixed wants to merge 5 commits into
Conversation
Loopback peers were admitted as admins, and could use token-less inference, on peer address alone. A hostile page in a local operator's browser can rebind its hostname to 127.0.0.1: its requests then come from loopback, are same-origin, and can send X-Cerberus-CSRF, so it could read the active config, activate or roll back revisions, and spend provider quota. Loopback trust now also requires the Host header to name this machine (localhost, *.localhost, 127.0.0.0/8, ::1) or a name the operator lists in server.trusted_hosts. Tests move from Host "test" to "localhost". SECURITY.md notes the same-host reverse proxy case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lj4neZ1qzw7tpiCJ8oedxJ
Deep-Sixed
force-pushed
the
claude/sleepy-curie-g8429q-loopback-host
branch
from
September 28, 2026 09:16
e21626d to
a9f34e3
Compare
This was referenced Sep 28, 2026
…8429q-loopback-host
Merging main brought in tests/test_jev_router_dispatch.py, whose client used Host "t". Loopback trust now also requires a local Host, so the test client moves to localhost like every other test in this PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lj4neZ1qzw7tpiCJ8oedxJ
…8429q-loopback-host
Merging main brought in tests/test_jev_dispatch.py, whose client used Host "t". Loopback trust now also requires a local Host, so the test client moves to localhost like every other test in this PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lj4neZ1qzw7tpiCJ8oedxJ
Deep-Sixed
marked this pull request as ready for review
October 11, 2026 00:42
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
admin_gate/admin_deniedadmit any loopback peer as an admin, and token-less mode opens inference to it, based on the peer address alone. A hostile page open in a local operator's browser can rebind its own hostname to127.0.0.1. Its requests then come from loopback, count as same-origin, and can sendX-Cerberus-CSRF. That is enough to read the active config and events, activate or roll back revisions, run provider probes, and use the open inference endpoint.Change
Hostheader to name this machine:localhost,*.localhost,127.0.0.0/8or::1.server.trusted_hostssetting (empty by default).http://testtohttp://localhost. This is mechanical; test behavior is unchanged.SECURITY.mdexplains the rule and warns against a same-host reverse proxy that forwards to 127.0.0.1 with a loopbackHost.Tests
tests/test_loopback_host.pycovers header parsing, a rebound Host being refused for admin reads, mutations and token-less inference, and local Hosts still being accepted.🤖 Generated with Claude Code
https://claude.ai/code/session_01Lj4neZ1qzw7tpiCJ8oedxJ
Generated by Claude Code