Piotr Mlocek e64b0352e8 feat(middleware): broaden HTTP header mutation authority (#3072) ...

* feat(middleware): broaden HTTP header mutation authority

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): protect response credential headers from mutation

Response middleware could write or remove Set-Cookie, WWW-Authenticate,
Authentication-Info, and Proxy-Authentication-Info, letting a stage plant
or strip credentials the sandbox client acts on. Protect them in both
directions, matching the request profile's treatment of Authorization and
Cookie, and reserve the x-openshell-credential prefix for responses too.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

* fix(middleware): reject credential placeholder writes

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

---------

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

2026-09-02 22:57:14 +00:00

..

openshell-bootstrap

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-cli

fix(cli): preserve provider type on credential updates (#3109)

2026-09-02 16:52:49 +00:00

openshell-conformance

test(e2e): run conformance in gateway lanes (#2925)

2026-09-01 12:36:51 +00:00

openshell-conformance-cli

test(e2e): run conformance in gateway lanes (#2925)

2026-09-01 12:36:51 +00:00

openshell-core

feat(middleware): broaden HTTP header mutation authority (#3072)

2026-09-02 22:57:14 +00:00

openshell-driver-db-credstore

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-driver-docker

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

openshell-driver-kubernetes

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

openshell-driver-kubernetes-secrets

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-driver-mxc

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

openshell-driver-podman

refactor(compute): decouple gateway driver composition (#2823)

2026-09-01 21:13:45 +00:00

openshell-driver-vault

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-driver-vm

fix(vm): retry transient registry requests (#3134)

2026-09-02 19:04:54 +00:00

openshell-extension-core

feat(driver-mxc): native Windows MXC compute driver + server wiring (#2721)

2026-08-27 07:24:04 +00:00

openshell-gateway

feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes (#3090)

2026-09-02 14:56:08 +00:00

openshell-gateway-interceptors

feat(server): add sandbox templates (#2833)

2026-09-02 00:55:29 +00:00

openshell-ocsf

test: backfill coverage for OCSF logging (#3065)

2026-08-31 23:02:30 +00:00

openshell-otel

feat(kubernetes): export driver traces over OTLP (#2958)

2026-08-26 21:22:51 +00:00

openshell-otel-test-support

feat(gateway): identify gateways in exported traces (#2647)

2026-08-27 17:27:34 +00:00

openshell-policy

fix(policy): ignore advisor provenance during contract inference (#3069)

2026-09-01 17:02:39 +00:00

openshell-prover

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-providers

feat(providers): make profiles authoritative (#2962)

2026-09-01 19:22:07 +00:00

openshell-router

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-sandbox

feat(build): add defaults-without-telemetry feature alias (#2843)

2026-09-01 19:55:42 +00:00

openshell-sdk

feat(server): add sandbox templates (#2833)

2026-09-02 00:55:29 +00:00

openshell-server

fix(compute): fence stale container exits during start (#3132)

2026-09-02 19:05:35 +00:00

openshell-server-macros

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-supervisor-middleware

feat(middleware): broaden HTTP header mutation authority (#3072)

2026-09-02 22:57:14 +00:00

openshell-supervisor-middleware-builtins

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00

openshell-supervisor-network

feat(vm): support corporate HTTP forward proxy egress for microVM sandboxes (#3090)

2026-09-02 14:56:08 +00:00

openshell-supervisor-process

fix(podman): restore rootless workload SIGTERM shutdown (#3036)

2026-09-01 15:23:58 +00:00

openshell-tui

fix(tui): replace alpha badges with version (#3114)

2026-09-02 15:13:25 +00:00

openshell-vfio

chore: remove Bazel build support (#2840)

2026-08-20 15:08:09 +00:00