- تم شحنها
- 28 مايو 2026 في 11:53 م UTC
- صاحب البلاغ
- kamo
- إرتكب
- f0e813f
When LOS_PROXY_HMAC_SECRET env var is set, the proxy now computes **************** secret) and sends X-Proxy-Signature + X-Proxy-Timestamp alongside the X-Org-Id / X-Member-Id headers. KamoLOS's new ProxyHmacFilter validates this (±60s skew, constant-time compare) so a client bypassing kamo-internal can no longer spoof identity headers. Unset secret = local-dev pass-through (filter disabled on the backend side too).