Strip identity headers on myloan.*/api/ before the portal BFF relays them

FixKlusterServices
Shipped
September 10, 2026 at 8:37 PM UTC
Author
Kamo
Commit
778274f

KamoMLOS's BFF routes under /api/ (the /api/proxy/* passthrough, /api/session/extend, /api/chat/routing, /api/chat/subject-state) copy every client header except hop-by-hop ones onto calls made straight to kamowssecurity-service over cluster DNS. SecurityService's /api/security/entitlements/me takes its caller from X-Member-Id, so **************** answered for any member the client named, past both api-route's strip-identity-headers and APIService's InboundHeaders filter. Add kamomlos-api-route: HostRegexp(^myloan[.].+$) && PathPrefix(/api/) at priority 100, running strip-identity-headers ahead of the same kamo-middlewares chain kamomlos-route uses, to kamomlos-service:80. Traefik cleans the path before matching, so //api/, /./api/ and /x/../api/ are caught; locale-prefixed and encoded variants are redirected by the app's middleware and never reach the proxy. If this route is rejected, requests fall back to kamomlos-route. kamomlos-route itself is applied by the KamoMLOS repo's CI on every push, hence a carve-out here rather than an edit there.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing