Gateway: fail closed for loopback trusted-proxy auth

jacobtomlinson · jacobtomlinson · commit ef573d3ea6ab · 2026-03-31T12:55:44.000Z
diff --git a/src/gateway/auth.test.ts b/src/gateway/auth.test.ts
@@ -721,6 +721,22 @@ describe("trusted-proxy auth", () => {
     expect(() => assertGatewayAuthConfigured(auth, authConfig)).toThrow(/mutually exclusive/);
   });
 
+  it("still requires trustedProxy config before reporting a token conflict", () => {
+    const auth = resolveGatewayAuth({
+      authConfig: {
+        mode: "trusted-proxy",
+        token: "shared-secret",
+      },
+    });
+
+    expect(() =>
+      assertGatewayAuthConfigured(auth, {
+        mode: "trusted-proxy",
+        token: "shared-secret",
+      }),
+    ).toThrow(/no trustedProxy config was provided/);
+  });
+
   it("supports Pomerium-style headers", async () => {
     const res = await authorizeTrustedProxy({
       auth: {
@@ -762,7 +778,7 @@ describe("trusted-proxy auth", () => {
     expect(res.user).toBe("nick@example.com");
   });
 
-  describe("local-direct token fallback", () => {
+  describe("local-direct trusted-proxy requests", () => {
     function authorizeLocalDirect(options?: {
       token?: string;
       connectToken?: string;
@@ -787,38 +803,37 @@ describe("trusted-proxy auth", () => {
       });
     }
 
-    it("allows local-direct request with a valid token", async () => {
-      const res = await authorizeLocalDirect({
-        token: "secret",
-        connectToken: "secret",
-      });
-      expect(res.ok).toBe(true);
-      expect(res.method).toBe("token");
-    });
-
-    it("rejects local-direct request without credentials", async () => {
-      const res = await authorizeLocalDirect({
-        token: "secret",
-      });
-      expect(res.ok).toBe(false);
-      expect(res.reason).toBe("token_missing");
-    });
-
-    it("rejects local-direct request with a wrong token", async () => {
-      const res = await authorizeLocalDirect({
-        token: "secret",
-        connectToken: "wrong",
-      });
-      expect(res.ok).toBe(false);
-      expect(res.reason).toBe("token_mismatch");
-    });
-
-    it("rejects local-direct request when no local token is configured", async () => {
-      const res = await authorizeLocalDirect({
-        connectToken: "secret",
-      });
+    it.each([
+      {
+        name: "without credentials",
+        options: {
+          token: "secret",
+        },
+      },
+      {
+        name: "with a valid token",
+        options: {
+          token: "secret",
+          connectToken: "secret",
+        },
+      },
+      {
+        name: "with a wrong token",
+        options: {
+          token: "secret",
+          connectToken: "wrong",
+        },
+      },
+      {
+        name: "when no local token is configured",
+        options: {
+          connectToken: "secret",
+        },
+      },
+    ])("rejects local-direct request $name", async ({ options }) => {
+      const res = await authorizeLocalDirect(options);
       expect(res.ok).toBe(false);
-      expect(res.reason).toBe("token_missing_config");
+      expect(res.reason).toBe("trusted_proxy_loopback_source");
     });
 
     it("rejects trusted-proxy identity headers from loopback sources", async () => {
@@ -867,7 +882,7 @@ describe("trusted-proxy auth", () => {
       expect(res.reason).toBe("trusted_proxy_loopback_source");
     });
 
-    it("uses token fallback for direct loopback even when Host is not localish", async () => {
+    it("rejects direct loopback even when Host is not localish", async () => {
       const res = await authorizeGatewayConnect({
         auth: {
           mode: "trusted-proxy",
@@ -885,8 +900,8 @@ describe("trusted-proxy auth", () => {
         } as never,
       });
 
-      expect(res.ok).toBe(true);
-      expect(res.method).toBe("token");
+      expect(res.ok).toBe(false);
+      expect(res.reason).toBe("trusted_proxy_loopback_source");
     });
 
     it("rejects same-host proxy request with missing required header", async () => {
diff --git a/src/gateway/auth.ts b/src/gateway/auth.ts
@@ -452,38 +452,14 @@ export async function authorizeGatewayConnect(
   if (auth.mode === "trusted-proxy") {
     // Same-host reverse proxies may forward identity headers without a full
     // forwarded chain; keep those on the trusted-proxy path so allowUsers and
-    // requiredHeaders still apply. Only raw local-direct traffic falls back.
+    // requiredHeaders still apply.
     if (!auth.trustedProxy) {
       return { ok: false, reason: "trusted_proxy_config_missing" };
     }
     if (!trustedProxies || trustedProxies.length === 0) {
       return { ok: false, reason: "trusted_proxy_no_proxies_configured" };
     }
 
-    const proxyUserHeader = auth.trustedProxy?.userHeader?.toLowerCase();
-    const hasProxyIdentityHeader =
-      proxyUserHeader !== undefined && Boolean(req?.headers?.[proxyUserHeader]);
-    if (localDirect && !hasProxyIdentityHeader) {
-      if (limiter) {
-        const rlCheck: RateLimitCheckResult = limiter.check(ip, rateLimitScope);
-        if (!rlCheck.allowed) {
-          return {
-            ok: false,
-            reason: "rate_limited",
-            rateLimited: true,
-            retryAfterMs: rlCheck.retryAfterMs,
-          };
-        }
-      }
-      return authorizeTokenAuth({
-        authToken: auth.token,
-        connectToken: connectAuth?.token,
-        limiter,
-        ip,
-        rateLimitScope,
-      });
-    }
-
     const result = authorizeTrustedProxy({
       req,
       trustedProxies,
