authheaders

Sep 22, 2026

Changes in this version

+ const DefaultExtraHeaderPrefix

+ const DefaultGroupHeader

+ const DefaultUserHeader

Jun 23, 2026 GO-2026-6517

  GO-2026-6517: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Jun 25, 2026

Changes in this version

+ func ClearAuthHeaders(header http.Header, userHeader, groupHeader, extraHeaderPrefix string)

Jun 23, 2026 GO-2026-6517

  GO-2026-6517: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

Changes in this version

+ func SetAuthHeaders(header http.Header, user userinfo.Info, ...)