- Shipped
- September 23, 2026 at 11:04 AM UTC
- Author
- Kamo
- Commit
- e305298
The chat attachment upload, the support bug-report screenshot upload, the meet background upload and the two ConversionService image-resize proxies all called buildForwardHeaders and then read or piped the request body regardless of whether an X-OTK came back. An anonymous caller could still make this process spool a multipart body — up to a few GB on the chat and screenshot routes, which stream via raw node:http specifically so a large upload never sits in memory — into a request to MediaService or ConversionService before either backend got a chance to say there was no session. Both a resource-exhaustion and an auth-bypass-shaped hole: the proxy did real work (buffering, in some cases a ConversionService resize) on behalf of a caller it never authenticated. The rule now matches the sibling routes that already had it right (sound-effects upload, imaging upload, imaging template upload): build the headers, and return 401 the moment X-OTK is missing, before the body is touched. meet/backgrounds also had its steps reordered so the header check runs before formData() is parsed rather than after.