feat: authenticate to the bridge via a trusted-service secret (prod) - #8
Merged
Conversation
Prod builder calls the bridge server-side using only the dev X-Mind-Dev-WebId header, which the bridge honors only when !isProd. So every build action 401s "no session; sign in via /connect" in prod. When BUILDER_BRIDGE_SERVICE_SECRET is set, attach X-Mind-Service-Secret + X-Mind-On-Behalf-Of:<webid> instead; the bridge accepts this in prod when its matching BRIDGE_SERVICE_SECRET is set (codespaces#15). Unset → falls back to the dev header (unchanged local behavior). Follow-up: builder still trusts the browser's claimed x-mind-webid without proof, so a secret holder can act as any WebID. Verifying WebID control (Solid-OIDC token) is the next hardening step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Prod builder calls the codespaces bridge server-side using only the dev
X-Mind-Dev-WebIdheader, which the bridge honors only when!isProd. In production it's ignored → every build action 401sno session; sign in via /connect. (Reproduced live.)What
When
BUILDER_BRIDGE_SERVICE_SECRETis set,bridgeAuthHeadersattachesX-Mind-Service-Secret+X-Mind-On-Behalf-Of: <webid>. The bridge accepts this in prod when its matchingBRIDGE_SERVICE_SECRETis set (MIND-Studio/codespaces#15). Unset → falls back to the dev header (unchanged local behavior).Follow-up (known)
builder still trusts the browser's claimed
x-mind-webidwithout proof, so a secret holder can act as any WebID. Verifying WebID control (Solid-OIDC token) is the next hardening step.🤖 Generated with Claude Code