/api/los proxy HMAC-signs identity headers

Featurekamo-internal
Ya
28 Mei 2026, 23:53 UTC
Mwandishi
kamo
Ahadi ya
f0e813f

When LOS_PROXY_HMAC_SECRET env var is set, the proxy now computes **************** secret) and sends X-Proxy-Signature + X-Proxy-Timestamp alongside the X-Org-Id / X-Member-Id headers. KamoLOS's new ProxyHmacFilter validates this (±60s skew, constant-time compare) so a client bypassing kamo-internal can no longer spoof identity headers. Unset secret = local-dev pass-through (filter disabled on the backend side too).

Mabadiliko yote

Je, unaona nini kuhusu usafiri?

Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.

Kuwa Huru MileleMtazamo wa bei