Dan Milne 2d5650e620 Bind forward-auth fa_token to its destination host ...

An observed fa_token (via Referer leaks, access logs, JS monitors)
could previously be redeemed against a different reverse-proxied app
within the 60s TTL. The token now stores the destination host at
creation and the verifier rejects mismatches without burning the cache
entry, so legitimate destinations can still redeem.

Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>

2026-04-20 19:04:53 +10:00

5.4 KiB

Raw Blame History

View Raw