fix: strip client-supplied Ory-* headers before re-applying

Prevents clients from spoofing Ory-Base-URL-Rewrite*, Ory-Base-URL-Rewrite-Token,
and Ory-No-Custom-Domain-Redirect headers. Spoofed headers would otherwise be
forwarded unchanged to the developer's upstream app, or — when no API key is
configured — passed through to Ory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aeneasr

cmd/cloudx/proxy/helpers.go

@@ -298,6 +298,15 @@ and configure your SDKs to point to it, for example in JavaScript:
 // upstream application do not need — and must not receive — these headers.
 func reqMiddleware(conf *config, oryURL *url.URL, apiKey string) proxy.ReqMiddleware {
 	return func(r *httputil.ProxyRequest, c *proxy.HostConfig, body []byte) ([]byte, error) {
+		// Strip any client-supplied Ory-* headers before selectively re-applying
+		// them below. Otherwise a client could spoof these headers: they would be
+		// forwarded unchanged to the developer's upstream app, or — when apiKey is
+		// empty — an attacker-supplied Ory-Base-URL-Rewrite-Token would be passed
+		// through to Ory.
+		r.Out.Header.Del("Ory-No-Custom-Domain-Redirect")
+		r.Out.Header.Del("Ory-Base-URL-Rewrite")
+		r.Out.Header.Del("Ory-Base-URL-Rewrite-Token")
+
 		if r.Out.URL.Host == oryURL.Host {
 			r.Out.URL.Path = strings.TrimPrefix(r.Out.URL.Path, conf.pathPrefix)
 			r.Out.Host = oryURL.Host

cmd/cloudx/proxy/helpers_test.go

@@ -70,4 +70,41 @@ func TestReqMiddleware(t *testing.T) {
 		assert.Equal(t, "upstream.internal", r.Out.Host)
 		assert.Empty(t, r.Out.Header.Get(headerToken), "API key must not leak to the upstream app")
 	})
+
+	t.Run("case=client-spoofed Ory headers are stripped from upstream-bound requests", func(t *testing.T) {
+		conf := &config{publicURL: publicURL}
+		r := newRequest(t, "localhost:3000")
+		r.Out.Header.Set(headerToken, "ory_apikey_spoofed")
+		r.Out.Header.Set(headerRewrite, "http://evil.example")
+		r.Out.Header.Set(headerNoCustom, "true")
+
+		_, err := reqMiddleware(conf, oryURL, apiKey)(r, &proxy.HostConfig{}, nil)
+		require.NoError(t, err)
+
+		assert.Empty(t, r.Out.Header.Get(headerToken), "spoofed token must not be forwarded to the upstream app")
+		assert.Empty(t, r.Out.Header.Get(headerRewrite), "spoofed header must not be forwarded to the upstream app")
+		assert.Empty(t, r.Out.Header.Get(headerNoCustom), "spoofed header must not be forwarded to the upstream app")
+	})
+
+	t.Run("case=client-spoofed token is stripped from Ory-bound requests when apiKey is empty", func(t *testing.T) {
+		conf := &config{publicURL: publicURL}
+		r := newRequest(t, oryURL.Host)
+		r.Out.Header.Set(headerToken, "ory_apikey_spoofed")
+
+		_, err := reqMiddleware(conf, oryURL, "")(r, &proxy.HostConfig{}, nil)
+		require.NoError(t, err)
+
+		assert.Empty(t, r.Out.Header.Get(headerToken), "spoofed token must not be passed through to Ory when apiKey is empty")
+	})
+
+	t.Run("case=real apiKey overwrites a client-spoofed token on Ory-bound requests", func(t *testing.T) {
+		conf := &config{publicURL: publicURL}
+		r := newRequest(t, oryURL.Host)
+		r.Out.Header.Set(headerToken, "ory_apikey_spoofed")
+
+		_, err := reqMiddleware(conf, oryURL, apiKey)(r, &proxy.HostConfig{}, nil)
+		require.NoError(t, err)
+
+		assert.Equal(t, apiKey, r.Out.Header.Get(headerToken), "genuine key must overwrite any spoofed token")
+	})
 }