Gateway: refuse null and foreign loopback origins, check Host, protect Carrier bootstrap

Part of #173 (isolation plan); related: #83.

The gateway accepts cross-origin requests from Origin: null and from any loopback origin on any port (elastos-server/src/api/browser_capsules.rs:26-40), applied to every route (api/gateway.rs:1245), with no Host or DNS-rebinding check outside the handlers that use gateway_origin.rs. /api/carrier/bootstrap needs no sign-in and returns the Carrier ticket, node ID and device DID (api/gateway_room.rs:304-342). A page on the internet can use a sandboxed iframe (origin null) to read a local Home's bootstrap data, and any web page on another localhost port is treated as a trusted origin. App capsules get no Content-Security-Policy; only Home and its shells do (browser_capsules.rs:328-354).

Done means

Origin: null is accepted only together with a valid launch token. Routes that work without a token form one explicit public list (health, install.sh, release files, artifacts, the operator site); the Carrier bootstrap is not on it. Other loopback ports are refused. Test covers an internet page in a sandboxed iframe, a page on another localhost port and a DNS-rebinding host.
The gateway checks the Host header against its configured names (DNS-rebinding protection).
Carrier bootstrap data is returned only to an authorized caller, or only the public part on a public seed by explicit configuration.
Anonymous sign-in does not reveal other accounts' credential IDs (today begin_authentication returns every stored credential ID, elastos/crates/elastos-identity/src/webauthn.rs:617-631); sign-in uses discoverable credentials or returns no list. Challenge creation and registration have bounded capacity and rate limits. Test: flood both endpoints while another guest completes sign-in; no credential list leaks.
The session or token is checked before a request body is read. Test: an unauthenticated 100 MB POST is refused after less than 1 MB is read.
Every app and shell document other than Home's top-level page (the Runtime-owned host after Home: split into a Runtime-owned host and a sandboxed Home GUI capsule #176) carries Content-Security-Policy: sandbox (without allow-same-origin), script-src 'self' and a connect-src that allows only the gateway; Runtime places scoped, short-lived app capabilities into each frame, with real stop #177 narrows it to manifest-declared egress (CID and site pages: Serve CID and user content in an opaque sandbox, never as Home #168). Test: a top-level navigation or an escaped popup to /apps/<app>/ cannot call a Home route or read Home's cookie.
Documents escapes Markdown output. Today capsules/documents/browser/index.html:1667-1675 inserts the code-fence language unescaped into a class attribute, so a shared Markdown file can inject script. The language is escaped or restricted to [A-Za-z0-9+#-], and every other Markdown field is escaped the same way. Test: a hostile fence and a hostile case for each other field create no element or event handler.
Regression tests cover each refused case.
The installed, signed-in Home journey from ci: prove signed SmolLM2 Get and Assistant reply in fresh Homes #153 opens Marketplace and Assistant on fix(gateway): let apps open inside the sandboxed home shell #202's exact head before merge, and then on the exact merged develop commit; receipts bind source commit/tree and installed Runtime/provider hashes.
A foreign app frame stays opaque and receives no Home cookie, launch token or API authority; the signed-in permitted launch still works. Foreign embedding of the static app document itself is allowed under option (1).
The existing ci: prove signed SmolLM2 Get and Assistant reply in fresh Homes #153 core journey runs in the named .github/workflows/ci.yml dispatch-only Gateway: refuse null and foreign loopback origins, check Host, protect Carrier bootstrap #167 proof job, with pinned harness provenance and complete owned-process cleanup; this is installed proof, separate from source browser fixtures.

Part of #173 (isolation plan).

Runtime owns accepted gateway names, caller authority, Carrier bootstrap and bounded sign-in challenges.
#167 starts from #188 candidate acfe57f1, with PR target develop; its merge waits for #188 integration.
The #188 hang is identified as Playwright 1.59.1 ZIP extraction on Node 26; corrected run 36932494769 is active.
The combined Done means includes opaque app documents, body admission, credential privacy and Documents Markdown escaping, with refused-case regressions.
This session uses a separate worktree; Irzhy review follows green checks, and his approval gates merge.

Runtime now checks configured gateway authorities and caller authority before body extraction; private Carrier bootstrap requires an authorized caller.
App and shell documents receive an opaque sandbox policy, while inline first-party scripts move to same-origin assets; Home keeps its sign-in recovery path.
Documents passes 20 Markdown regressions and 19 hostile DOM cases, with existing edit, save and close fixture checks passing.
Sign-in code uses discoverable credentials, separate bounded challenge pools and real-peer begin limits; Rust and actual-gateway regressions are in validation.
#167 remains In progress on #188 candidate acfe57f; installed compatibility for existing nondiscoverable passkeys and review remain open.

Runtime admits configured gateway hosts and signed app launches before body extraction; existing native Browser operator sessions keep their exact route scope.
The first actual-browser app probe used cookie credentials with header authority; its fixture now uses the same credential mode as app requests.
The broader gateway run passed 521 cases and found 54 policy-related fixture changes plus two missing provider fixture binaries; validation continues.
Anonymous Chat pairing now requires Home authority, so its guest journey stays open for #183; existing nondiscoverable passkey compatibility also remains open.
#167 stays In progress from #188 candidate acfe57f; independent review has started, and PR preparation follows the corrected checks.

Independent review found missing first-party CORS headers and a WebAssembly startup restriction in the new app policy.
The candidate now keeps the existing upload, recovery and save headers, permits WebAssembly compilation, and retains JavaScript string-compilation refusal.
Home, Browser, clipboard, Documents, Archive, Chat and Inbox source regressions pass; the two existing private Runtime data tests are retained.
The shared Mac build lease belongs to the active local AI proof; #167 waits for that lease and keeps the 15% disk floor.
#167 remains In progress from acfe57f; corrected Rust/browser validation, passkey migration, anonymous Chat acceptance and the second review round remain open.

The corrected candidate keeps signed app header requests, first-party CORS protocol headers and opaque WebAssembly execution.
The browser fixture now checks JavaScript compilation from its own script, because DevTools evaluation bypasses that CSP check.
Home and Browser entropy, clipboard and product source checks pass; 72 Node regressions and 13 Documents save-conflict cases pass.
The Mac build lease is now owned by #167; free disk is 16.3%, and corrected Rust test compilation is active.
#167 remains In progress from acfe57f; actual-gateway browser and Rust results, passkey migration and anonymous Chat acceptance remain open.

The corrected gateway run passed 574 cases; four remaining results concern response-header expectations, revoked sessions and Home actor refusal.
The actual browser probe found that a valid Assistant launch could receive Home's old unsigned summary; the front door now checks Home and shell authority for Home routes.
The 100 MB refused-case matrix includes that valid Assistant launch, and the browser probe retains the Home-route 403 assertion.
Gateway authority parsing now also rejects numeric ports above 65535 before the host configuration is written; corrected Rust compilation is active.
#167 stays In progress; passkey migration and the anonymous Chat journey remain acceptance blockers, and #170 waits for this task.

Runtime now refuses Home routes before body extraction when the caller holds only an Assistant launch.
Local validation passed 577 gateway cases plus the corrected GBA regression, 77 authentication cases, 58 identity cases, 24 capsule cases and the full content-boundary browser test.
The browser proof covers direct app documents, extra HTML/SVG, opaque internet frames, foreign loopback ports, DNS rebinding and the popup blocked by the existing response policy.
The basic format, entropy and diff gates pass; two provider-fixture cases require CI binaries, and the final independent review is active.
#167 remains In progress from #188 candidate acfe57f; existing-passkey recovery and the anonymous Chat journey remain acceptance gates before merge.

Runtime now owns Host admission, request authority, bounded sign-in and opaque app documents in draft PR #197.
Candidate 0ead0bc starts from #188 candidate acfe57f and targets develop; the task branch matches origin with divergence 0/0.
Local Rust, actual-browser, Markdown and basic gates pass; both independent source review rounds pass on diff SHA-256 bac26d3723b3677c96bba9035a5f2f5caeb1402b8eb96c0df890e0f0fa38a3e4.
CI now checks the exact candidate, including the two native provider fixtures that lack local binaries; Irzhy is requested only after green checks and draft exit.
#167 stays open in QA / Review; existing-passkey recovery, anonymous Chat acceptance and #188 integration remain merge gates, with #170 next.

Proposed legacy passkey path: a user supplies one local credential hint, while anonymous authentication continues to return an empty credential list.
An existing-only host reader selects one active credential and emits its ID and RP metadata; it preserves stored state and keeps key material private.
Signed-out Home can use the hint in memory for the existing authenticator call; completion keeps the current signature, challenge, origin, RP, revocation and role checks.
Acceptance would prove a disposable nondiscoverable Admin credential retains the same principal, root and role, with refusal for wrong RP, stale challenge, revoked binding and invalid proof.
This design adds local recovery controls within existing sign-in authority; the compatibility scope decision remains pending, and direct Chat can route users through signed Home while anonymous admission stays open.

CI for candidate 0ead0bc passed the source gate and found one Clippy error in the new passkey admission helper's large Response error value.
The local correction boxes that refused response and keeps the same status, headers, body and pre-body admission behavior.
Focused Clippy and passkey regression validation follow under the single Mac build lease; the existing refused-case tests remain in the candidate.
Draft PR #197 targets develop and keeps #188 as its integration dependency.
#167 stays in QA / Review; the compatibility scope question for legacy passkeys and anonymous Chat remains pending, with #170 next.

#167 / PR #197 candidate 678ae6b195dd444b7a469a568f9355cd3c75cecb is ready for review.
CI run 36950212069 passes all eight required checks on Linux x86/ARM and macOS; release publication is skipped.
The Linux job proves both real-browser sandbox/legacy-key journeys and the prior catalogue, step-up, streaming and native custody gateway cases.
irzhywau is requested; his approval and #188 integration remain merge gates, with develop's later cache-only change checked for compatibility.
#170 source preparation continues in its own worktree; exact installed UI proof, public correction approval and publication remain its acceptance gates.

PR #197 now targets develop after #188 merged; GitHub reported a conflict against the moving base.
A normal local merge of develop 0cba4e67 completed automatically as 14dfba3c; its tree is edc0972e9b5c1ee7b10544f1f6a4808ddd84d2cc.
The merged changes are the accepted model-readiness fix and CI baseline; #167 own commits remain unchanged, with the Claude Opus PASS preserved.
Diff checks, Home entropy, both formatting gates and all five CI policy tests pass; the candidate was fast-forward pushed to origin for fresh CI.
#167 waits for that candidate's green run before merge; non-blocking review notes are recorded in #177 and #174.

PR #197 merged into develop as 6443f32110d4f86db9ca804f4a5725b8519fab0c; candidate 14dfba3c07cd2852c570216ac6572057e8e2e178.
CI 36961534483 passes all eight checks, including workspace tests, actual-browser sandbox/legacy-key journeys and three source-home platforms.
Refused cases cover null/foreign/other-port origins, rebinding Host, opaque app authority, credential privacy and bounded challenges, pre-body rejection and hostile Markdown.
Operator-run Claude Opus review records PASS for #167 own commits; the normal baseline merge passed focused compatibility review and fresh CI.
All Done means are proven; #167 closes, its non-blocking notes remain in #177/#174, and #195 integration is the next merge candidate.

Reopened by the operator, 2 October 05:20 UTC: #197 blocks app frames in the installed Home. Marketplace fails with ERR_BLOCKED_BY_RESPONSE right after sign-in (PR #136 Mac job https://github.com/Elacity/elastos-runtime/actions/runs/36964466444/job/110705448425 and PR #153 job 110707968717). Cause (operator check of develop): browser_capsules.rs:334-337 sets app documents to frame-ancestors , but the Home GUI shell that mounts them is itself a sandboxed opaque document, and CSP checks every ancestor, so no app can load inside it. develop CI did not catch it because no develop job opens an app in the installed Home yet (#153 adds that).
Done means added: Marketplace and Assistant launch through the real signed-in Home shell (test), while a foreign site still cannot frame an app (test).

Operator analysis for the fix (05:45 UTC):
Cause: CSP Level 3 frame-ancestors checks every ancestor by parsing its serialized origin. An opaque origin serializes to "null", which never matches a source list, so any app document with frame-ancestors is blocked as soon as one ancestor (the sandboxed Home GUI shell) is opaque. No source expression can name the shell.
Options: (1) Drop frame-ancestors from app documents for now. A foreign site that frames /apps// gets an opaque, sandboxed document with no launch token and no Home cookie (SameSite=Strict is not sent from an opaque origin), so it holds no authority; #176 restores frame-ancestors once the Runtime-owned host mounts app frames directly. (2) Keep frame-ancestors and stop sandboxing the Home GUI shell; this undoes part of #167 and conflicts with T2. Recommendation: (1), with tests that Marketplace and Assistant launch through the signed-in Home shell and that a framed app from a foreign origin has no token and no cookie.

Fix candidate for the app-frame regression: #202, head 3bceced34, based on develop 17132f05b and merging cleanly with 829a24ad7.

#202 applies option (1). Home keeps frame-ancestors 'none', and the Home GUI and CLI shells keep frame-ancestors <Home origin>. App and viewer documents rely on the response sandbox until #176 gives the Runtime-owned host direct control of app frames.

Proof:

content_sandbox_browser opens Home, the sandboxed shell and then Assistant and Marketplace from real gateway responses. It fails on develop and passes on fix(gateway): let apps open inside the sandboxed home shell #202.
A hostile page in the signed-in browser can display Assistant, while the gateway keeps the Home cookie, launch token and API authority with Home. The browser sends the frame request without the Home cookie, and unsigned API calls get 403.
A real signed-in Home on macOS, built from 3bceced34, opens Marketplace and Assistant after Touch ID (video shared with Anders).

CI: 8 of 9 checks pass. source-home-linux (ubuntu-24.04) stops at the Kubo download while dist.ipfs.tech is unreachable, and it re-runs when the site returns.

Done means: option (1) replaces "a foreign site still cannot frame an app" with "a foreign frame receives an opaque document, and Home keeps its cookie, launch token and API authority". Please confirm this wording. Review: an independent ChatGPT review, and Irzhy for isolation.

PR #202 at 3bceced34ddb0b79139becc3e933745556349b55 keeps its Codex source PASS; repaired exact-head installed #153 proof 37002735025 is running after the first attempt's pre-build Kubo timeout.

Use the trusted shell-ID helper for CSP shell classification rather than a package's declared role; the current role check adds restriction and grants no authority.
Extend foreign-framing coverage to Home and shells, plus viewer and secondary-document response paths.
Workflow-only 6155e69b fetches the checksum-identical official GitHub archive, runs the unchanged candidate verifier and its tampered-cache refusal; all four local gates pass. The separate Linux CI timeout remains with fix(gateway): let apps open inside the sandboxed home shell #202's owner.
Gateway: refuse null and foreign loopback origins, check Host, protect Carrier bootstrap #167 stays in QA until the installed journey passes on the exact candidate and merged develop; option (1) keeps foreign app bytes opaque and Home authority private, with Sasha's ready state and all green checks gating merge.

PR #202, exact head 3bceced34ddb0b79139becc3e933745556349b55 / tree 05c89ed8489234e4ba9f0b0ffababb5f9ada1446, passes the installed #153 core journey in 37002735025.
The real signed-in Home opens Marketplace, admits the pinned model package and opens Assistant for a real bounded reply; inspected receipts prove built/installed Runtime and provider parity, pinned test provenance and empty final owned-process cleanup.
The actual-browser sandbox refused cases and Codex adversarial source PASS remain current; the CI input also rejects a tampered Kubo archive before installation.
#167 remains in QA: #202 still needs Sasha's ready state and a green Linux check, then this same installed journey must pass on the exact merged develop commit before closure.
#199's authorized develop rebase and fresh operator review follow #202 integration; the existing non-blocking notes remain in this issue.

Wrap-up for #89: PR #202, head 3bceced34ddb0b79139becc3e933745556349b55, is pushed and remains draft with its owner; the source PASS and exact-head installed Marketplace/Assistant journey 37002735025 are verified.
Done: real signed-in Home launch, bounded real model reply, source/tree and Runtime/provider parity, pinned harness provenance, sandbox refused cases and owned-process cleanup.
Left: the required Linux Kubo-download check is red and Sasha has yet to mark ready; all merge gates remain in force.
Finish this wrap-up when Sasha's exact head has ready state and every check green; merge into develop, run the same journey on the exact merge SHA, then close #167 with that proof. Own proof branch fix/167-installed-home-proof is pushed at 6155e69b.
Further gateway/isolation development is parked; #89 is the active goal and this exception is limited to finishing #202 safely.

The Linux fixture repair is now integrated in develop a4c6628 through approved PR #216; it keeps the original pinned Kubo checksum.
PR #202 remains draft at 3bceced, with the current Codex source PASS and installed candidate journey 37002735025.
Resume with Sasha’s integration of the repaired baseline and ready state; the older failed workflow uses the older downloader, so repeating it unchanged would miss this repair.
A changed head requires current review evidence, green checks and the exact-head signed-in Marketplace/Assistant journey; merge then requires that journey on the exact develop merge commit before #167 closes.
#201’s gateway acceptance also waits for this working frame baseline; the rest of the isolation queue stays parked under #89.

PR202 merged into develop as 1327347 / tree a7f65054bbd6a744f1894657e02397f017ad7f74, after Codex PASS, green CI37048331449 and accepted candidate installed proof37048532582.

Use trusted Home-shell IDs when classifying shell ancestors; the current manifest-role check adds restriction and grants no authority.
Extend foreign-frame coverage to Home, shells, viewers and secondary documents; current fixtures prove nested app loading and foreign-frame refusal of API authority.
The exact merged-develop journey is active in run37057427709, with ref 1327347. Closure waits for its source/install/provider receipts, signed-in Marketplace and Assistant journey, and empty owned-process cleanup.
The accepted develop baseline then gates Publish and serve frozen releases with separate signing custody #201 and the M1 handoff in G1 Install and update: Signed update #89; other isolation work stays parked.

PR202 is merged with Codex adversarial PASS, green CI and accepted candidate installed proof.
The merged-develop installed proof passed on source132734728c3c60a57840c2a2b692763a836433b8/tree a7f65054bbd6a744f1894657e02397f017ad7f74; Runtime built=installed SHA256 e0a959e1950752016c35a1c6795a7cbdd92f4fce357392c20c5ce3900aa74c3e and model-provider built=installed 4a913f0b27329bd76a4af696a6680baba82395a43262eb91801a3f3898c79d01.
Artifact11250602969 binds clean source, installation/components and the independently verified cd00623 core plus aa9a2bd eight-token request; the signed-in Marketplace/Assistant journey passed in107.4s with a real reply, desktop/phone screenshots inspected and final owned-process list empty.
The actual browser regressions passed nested app launch and foreign-frame cookie/storage/API refusal; option(1) permits static foreign embedding while keeping the app opaque and its authority scoped. The proof-only workflow stays separate from product.
All Done means are proven; #167 closes. Remaining frame-hardening notes are retained under #173, and the accepted baseline now feeds PR201 for #89.

Navigation Menu

Repository navigation

Gateway: refuse null and foreign loopback origins, check Host, protect Carrier bootstrap #167

8 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Gateway: refuse null and foreign loopback origins, check Host, protect Carrier bootstrap #167

Description

Activity

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

andersalm commented on Oct 1, 2026

8 remaining items

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

SashaMIT commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

andersalm commented on Oct 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions