[Security][High] Constrain and resource-limit the authenticated WMS proxy #15

New Issue

2026-07-23T09:27:43Z

jfig commented

2026-07-23 09:27:43 +00:00

Severity

High — unauthenticated network-facing gateway with credential and availability risks.

Finding

The public /api/wms route accepts arbitrary query parameters and forwards them to the configured GeoServer endpoint with the same Basic Authorization header.

Confirmed properties:

Requests are not restricted to WMS; callers can request WFS operations and arbitrary published properties.
The same credential is sent to every configured allowed endpoint.
Allowed endpoints may use plaintext HTTP.
Upstream responses are fully buffered in memory with no maximum size.
There is no connect, response, or total timeout.
There is no rate, concurrency, or request-cost limit.
The container has no memory or PID limits.
The server listens on all interfaces by default.
Security response headers are not configured.

The exact endpoint allowlist successfully blocked a test request to a local PostgreSQL port, which should be preserved. CQL string escaping in the browser code also appears correct.

Impact

An unauthenticated caller can trigger expensive or very large GeoServer queries and cause memory, connection, CPU, or database exhaustion. Adding a third-party or compromised endpoint to the allowlist leaks the shared GeoServer credential. Plaintext endpoints expose Basic credentials to network observers.

Resolution proposal

Define an explicit allowlist of service, request, version, layer, output format, and safe parameter combinations.
Reject WFS and all non-required operations unless a separate authenticated route is intentionally designed.
Use a dedicated read-only account rather than an administrator credential.
Associate credentials with a single endpoint; never broadcast one credential to every allowed endpoint.
Require HTTPS except for a narrowly defined container-network target.
Stream responses with a strict byte ceiling rather than buffering them completely.
Add connect, header, idle, and total deadlines with cancellation on client disconnect.
Add per-IP/request rate limits, concurrency limits, and GeoServer query limits.
Add container memory and PID limits.
Add CSP, X-Content-Type-Options, frame protection, Referrer-Policy, and a minimal Permissions-Policy.
Log rejected and high-cost requests without logging credentials or sensitive query data.

Acceptance criteria

Only documented map operations and approved layers pass proxy validation.
WFS and unknown service/request combinations are rejected.
Responses over the configured limit are terminated safely.
Slow and unreachable upstreams time out.
Load tests demonstrate bounded memory and concurrency.
Credentials are scoped, non-admin, endpoint-specific, and never sent over an untrusted plaintext connection.
Rate limits and container resource limits are active.
Security headers have automated tests.

## Severity High — unauthenticated network-facing gateway with credential and availability risks. ## Finding The public `/api/wms` route accepts arbitrary query parameters and forwards them to the configured GeoServer endpoint with the same Basic Authorization header. Confirmed properties: - Requests are not restricted to WMS; callers can request WFS operations and arbitrary published properties. - The same credential is sent to every configured allowed endpoint. - Allowed endpoints may use plaintext HTTP. - Upstream responses are fully buffered in memory with no maximum size. - There is no connect, response, or total timeout. - There is no rate, concurrency, or request-cost limit. - The container has no memory or PID limits. - The server listens on all interfaces by default. - Security response headers are not configured. The exact endpoint allowlist successfully blocked a test request to a local PostgreSQL port, which should be preserved. CQL string escaping in the browser code also appears correct. ## Impact An unauthenticated caller can trigger expensive or very large GeoServer queries and cause memory, connection, CPU, or database exhaustion. Adding a third-party or compromised endpoint to the allowlist leaks the shared GeoServer credential. Plaintext endpoints expose Basic credentials to network observers. ## Resolution proposal 1. Define an explicit allowlist of service, request, version, layer, output format, and safe parameter combinations. 2. Reject WFS and all non-required operations unless a separate authenticated route is intentionally designed. 3. Use a dedicated read-only account rather than an administrator credential. 4. Associate credentials with a single endpoint; never broadcast one credential to every allowed endpoint. 5. Require HTTPS except for a narrowly defined container-network target. 6. Stream responses with a strict byte ceiling rather than buffering them completely. 7. Add connect, header, idle, and total deadlines with cancellation on client disconnect. 8. Add per-IP/request rate limits, concurrency limits, and GeoServer query limits. 9. Add container memory and PID limits. 10. Add CSP, `X-Content-Type-Options`, frame protection, `Referrer-Policy`, and a minimal `Permissions-Policy`. 11. Log rejected and high-cost requests without logging credentials or sensitive query data. ## Acceptance criteria - Only documented map operations and approved layers pass proxy validation. - WFS and unknown service/request combinations are rejected. - Responses over the configured limit are terminated safely. - Slow and unreachable upstreams time out. - Load tests demonstrate bounded memory and concurrency. - Credentials are scoped, non-admin, endpoint-specific, and never sent over an untrusted plaintext connection. - Rate limits and container resource limits are active. - Security headers have automated tests.

jfig added the

labels 2026-07-23 09:27:43 +00:00

Sign in to join this conversation.