- Shipped
- September 23, 2026 at 10:41 AM UTC
- Author
- Kamo
- Commit
- 2566947
media-route (HostRegexp ^media[.].+$) carried only media-websocket-upgrade, so a caller hitting media.<domain> directly could set X-Org-Id, X-Member-Id, X-Public-Chat-Org-Id, X-Public-Chat-Key-Hash and the rest of the identity header set itself and have MediaService see them unstripped - the same carve-out api-route, ai-chat-ws-route and the desktop-ws-route already apply at their own edges. Adds strip-identity-headers (namespace kamo, defined in KlusterServices traefik/middleware.yaml) ahead of media-websocket-upgrade in the middleware chain. Browsers never send these headers and in-cluster callers use the service DNS, so nothing legitimate depends on them reaching MediaService from outside the cluster. Validated with `kubectl apply --dry-run=server -f k8s/ingressroute.yaml` **************** configured (server dry run)).