- Shipped
- August 6, 2026 at 5:44 PM UTC
- Author
- Kamo
- Commit
- 860ea93
OTKAuthFilter bypasses only /actuator, /api/esig/public and /api/esig/internal, so this prefix is behind staff OTK auth with orgId/memberId already on the request. The recipient is never a path variable: it is resolved by matching EsignEnvelopeRecipient.memberId to the OTK member id, so there is no parameter a member can change to reach a colleague's row. Not-found, not-your-org and not-on-this-envelope all answer an identical 404. No /delegate — it hands a compliance document to an arbitrary external email with no approval and no disable flag; excluded by omission, not by a flag. No /decoder and no /stepup either: recipient-scoped decoder belongs to HR's void path, and step-up is keyed on a Redis signer session this surface does not have. signerIpAddress comes from a RIGHT-to-LEFT X-Forwarded-For walk. EsignPublicController.clientIp reads left-to-right, which is client-controlled and therefore spoofable, and that value lands on an evidentiary field.