From bd7c1640ee341bc15379b682ed67e7e43a29eca6 Mon Sep 17 00:00:00 2001 From: jenkins Date: Sun, 9 Aug 2026 13:40:58 -0300 Subject: [PATCH] security(hermes): canary current oauth proxy --- services/hermes/kustomization.yaml | 6 +++ .../hermes/oauth2-proxy-templates/error.html | 29 ++++++++++++ services/hermes/oauth2-proxy.yaml | 45 +++---------------- testing/tests/test_hermes_chat_quality.py | 12 ++--- 4 files changed, 47 insertions(+), 45 deletions(-) create mode 100644 services/hermes/oauth2-proxy-templates/error.html diff --git a/services/hermes/kustomization.yaml b/services/hermes/kustomization.yaml index 64f809003..a79efd17e 100644 --- a/services/hermes/kustomization.yaml +++ b/services/hermes/kustomization.yaml @@ -29,6 +29,12 @@ resources: - agent-ingress.yaml configMapGenerator: + - name: hermes-chat-oauth-templates + namespace: hermes + files: + - error.html=oauth2-proxy-templates/error.html + options: + disableNameSuffixHash: true - name: hermes-operator-guide namespace: hermes files: diff --git a/services/hermes/oauth2-proxy-templates/error.html b/services/hermes/oauth2-proxy-templates/error.html new file mode 100644 index 000000000..88398f11d --- /dev/null +++ b/services/hermes/oauth2-proxy-templates/error.html @@ -0,0 +1,29 @@ +{{define "error.html"}} + + + + + + {{.StatusCode}} {{.Title}} + {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}{{end}} + + + +
+ {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}} +

Signing you back in…

+

The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.

+ Continue now + {{else}} +

{{.StatusCode}} {{.Title}}

+ {{if .Message}}

{{.Message}}

{{end}} + Sign in again + {{end}} +
+ + +{{end}} diff --git a/services/hermes/oauth2-proxy.yaml b/services/hermes/oauth2-proxy.yaml index b6554e300..e6e4ef9be 100644 --- a/services/hermes/oauth2-proxy.yaml +++ b/services/hermes/oauth2-proxy.yaml @@ -9,43 +9,6 @@ data: brad@bstein.dev --- apiVersion: v1 -kind: ConfigMap -metadata: - name: hermes-chat-oauth-templates - namespace: hermes -data: - error.html: | - {{define "error.html"}} - - - - - - {{.StatusCode}} {{.Title}} - {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}{{end}} - - - -
- {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}} -

Signing you back in…

-

The previous one-time login callback expired or was already used. Hermes is starting a fresh sign-in automatically.

- Continue now - {{else}} -

{{.StatusCode}} {{.Title}}

- {{if .Message}}

{{.Message}}

{{end}} - Sign in again - {{end}} -
- - - {{end}} ---- -apiVersion: v1 kind: Service metadata: name: oauth2-proxy-hermes-agent @@ -276,7 +239,7 @@ spec: labels: app: oauth2-proxy-hermes-chat annotations: - ai.bstein.dev/config-rev: "20260809-expired-callback-recovery" + ai.bstein.dev/config-rev: "20260809-oauth2-proxy-7-15-canary" vault.hashicorp.com/agent-inject: "true" vault.hashicorp.com/agent-pre-populate-only: "true" vault.hashicorp.com/role: hermes-chat @@ -292,7 +255,7 @@ spec: automountServiceAccountToken: true containers: - name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0@sha256:dcb6ff8dd21bf3058f6a22c6fa385fa5b897a9cd3914c88a2cc2bb0a85f8065d + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3@sha256:10a1165743a192e1940b4708fb9647027185ce11a681a1c5519b442ff7f1f561 imagePullPolicy: IfNotPresent args: - --provider=oidc @@ -311,6 +274,9 @@ spec: - --cookie-path=/ - --cookie-secure=true - --cookie-samesite=lax + - --cookie-csrf-expire=10m + - --cookie-csrf-per-request=true + - --cookie-csrf-per-request-limit=8 - --cookie-refresh=1h - --cookie-expire=8h - --custom-templates-dir=/etc/oauth2-proxy/templates @@ -319,6 +285,7 @@ spec: - --http-address=0.0.0.0:4180 - --skip-provider-button=true - --reverse-proxy=true + - --trusted-proxy-ip=10.42.0.0/16 ports: - {name: http, containerPort: 4180} readinessProbe: diff --git a/testing/tests/test_hermes_chat_quality.py b/testing/tests/test_hermes_chat_quality.py index 2287f0eba..f7850f871 100644 --- a/testing/tests/test_hermes_chat_quality.py +++ b/testing/tests/test_hermes_chat_quality.py @@ -104,16 +104,16 @@ def test_chat_oauth_allows_stale_service_worker_retirement(): assert "--skip-auth-route=GET=^/sw[.]js([?].*)?$" in args assert "--custom-templates-dir=/etc/oauth2-proxy/templates" in args - template = next( - document - for document in documents - if document["kind"] == "ConfigMap" - and document["metadata"]["name"] == "hermes-chat-oauth-templates" - )["data"]["error.html"] + template = (HERMES / "oauth2-proxy-templates" / "error.html").read_text() assert 'http-equiv="refresh"' in template assert "Unable to find a valid CSRF token" in template assert "expired or was already used" in template assert "/sign_in?rd=/" in template + container = deployment["spec"]["template"]["spec"]["containers"][0] + assert "v7.15.3@sha256:10a1165743a192e" in container["image"] + assert "--cookie-csrf-per-request=true" in args + assert "--cookie-csrf-per-request-limit=8" in args + assert "--trusted-proxy-ip=10.42.0.0/16" in args def test_chat_auth_file_mount_survives_atomic_provider_refresh():