/api/los proxy HMAC-signs identity headers

Dikirim

28 Mei 2026 pukul 23.53 UTC

Penulis

kamo

Berkomitmen

f0e813f

When LOS_PROXY_HMAC_SECRET env var is set, the proxy now computes **************** secret) and sends X-Proxy-Signature + X-Proxy-Timestamp alongside the X-Org-Id / X-Member-Id headers. KamoLOS's new ProxyHmacFilter validates this (±60s skew, constant-time compare) so a client bypassing kamo-internal can no longer spoof identity headers. Unset secret = local-dev pass-through (filter disabled on the backend side too).