- Shipped
- 10 செப்டம்பர், 2026 அன்று 8:37 PM UTC
- Author
- Kamo
- Commit
- 778274f
KamoMLOS's BFF routes under /api/ (the /api/proxy/* passthrough, /api/session/extend, /api/chat/routing, /api/chat/subject-state) copy every client header except hop-by-hop ones onto calls made straight to kamowssecurity-service over cluster DNS. SecurityService's /api/security/entitlements/me takes its caller from X-Member-Id, so **************** answered for any member the client named, past both api-route's strip-identity-headers and APIService's InboundHeaders filter. Add kamomlos-api-route: HostRegexp(^myloan[.].+$) && PathPrefix(/api/) at priority 100, running strip-identity-headers ahead of the same kamo-middlewares chain kamomlos-route uses, to kamomlos-service:80. Traefik cleans the path before matching, so //api/, /./api/ and /x/../api/ are caught; locale-prefixed and encoded variants are redirected by the app's middleware and never reach the proxy. If this route is rejected, requests fall back to kamomlos-route. kamomlos-route itself is applied by the KamoMLOS repo's CI on every push, hence a carve-out here rather than an edit there.