Introduce WebServer Gateway Integration - #373
Conversation
📝 Contributor License Agreement requiredBefore this PR can merge, every contributor must sign the Infisical CLA. Still needs to sign: Once everyone has signed, the check updates automatically — no need to close and reopen the PR. |
|
| Filename | Overview |
|---|---|
| packages/pam/handlers/webserver/proxy.go | Adds the HTTP reverse proxy, but unbounded body buffering creates a Gateway denial-of-service path and target validation leaves SSRF-sensitive destinations unrestricted. |
| packages/pam/pam-proxy.go | Advertises and dispatches Web Server resources, passing API-provided target credentials into the new handler. |
| packages/pam/local/access.go | Adds loopback routing and user-facing connection details for interactive Web Server PAM sessions. |
| packages/pam/session/uploader.go | Recognizes Web Server recording filenames and uploads their records using the existing HTTP-event format. |
| cmd/test/main.go | Adds a loopback-only Basic Auth server for manual proxy validation. |
Reviews (1): Last reviewed commit: "add test web server" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| } | ||
| if err := req.Body.Close(); err != nil { | ||
| return fmt.Errorf("failed to close web server request body: %w", err) | ||
| } |
There was a problem hiding this comment.
When an authenticated PAM client sends a very large request body or selects an endpoint returning a very large response, the proxy buffers the complete body and recording data in memory without a size limit, causing the shared Gateway to become unavailable or be terminated for out-of-memory. How this was verified: The raw client stream reaches both unbounded io.ReadAll calls, and each resulting body is also passed to the session recorder.
Knowledge Base Used:
| if targetURL.Host == "" || (targetURL.Scheme != "http" && targetURL.Scheme != "https") { | ||
| return nil, fmt.Errorf("web server URL must include http or https scheme and host") | ||
| } | ||
| if targetURL.User != nil { | ||
| return nil, fmt.Errorf("web server URL must not include user info") | ||
| } |
There was a problem hiding this comment.
If a Web Server resource is configured with a loopback, private, link-local, metadata-service, or rebinding hostname, this validation accepts it and the Gateway resolves and connects to that address from its own network, enabling access to internal-only services. How this was verified: The API-provided target is checked only for an HTTP(S) scheme, host, and absent userinfo before being resolved by the Gateway's dialer.
Context Used: Flag SSRF risks (source)
Knowledge Base Used:
1 participant
Description 📣
Adds Web Server as a PAM resource handled directly by the Infisical Gateway, enabling HTTP request and response session recording for frontend browser access.
Changes
Adds the web-server gateway resource type and capability advertisement.
Routes frontend Web Server browser sessions through the PAM ALPN protocol instead of the generic TCP proxy.
Issues PAM certificates containing the session ID and Web Server resource type.
Adds a fixed-target HTTP/1.1 reverse-proxy handler that:
Adds CLI routing and loopback access for Web Server accounts.
Adds a local Basic Auth Go server for manual POC validation.
Notes
Type ✨
Tests 🛠️
# Here's some code block to paste some code snippets