Authentication Bypass via Forwarded Header Trust

Summary

An internal API accepted X-User-Id as a trusted identity source without enforcing origin restrictions. Requests sent directly to the service could spoof identity and bypass authentication checks.

Root Cause

The middleware assumed all traffic passed through a trusted proxy. The direct service listener remained exposed in a staging environment and later promoted unchanged to production.

GET /api/admin/billing HTTP/1.1
Host: api.example.internal
X-User-Id: 1001
X-Role: admin

Mitigation

1. Reject forwarded identity headers unless the request originates from a pinned proxy allowlist.
2. Replace header trust with signed service-to-service identity assertions.
3. Add regression tests that attempt direct service access with forged headers.