From 1f1abbf64d38ce1c85060fcad66eea15cb12de39 Mon Sep 17 00:00:00 2001 From: Stavros Date: Sun, 23 Aug 2026 17:37:46 +0300 Subject: [PATCH] fix: fail acl lookup when input domain doesn't match cookie domain --- internal/controller/proxy_controller_test.go | 1 + internal/service/access_controls_service.go | 8 ++++---- internal/service/access_controls_service_test.go | 6 ++++++ 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/internal/controller/proxy_controller_test.go b/internal/controller/proxy_controller_test.go index eff30935..fd06ae39 100644 --- a/internal/controller/proxy_controller_test.go +++ b/internal/controller/proxy_controller_test.go @@ -918,6 +918,7 @@ func TestProxyController(t *testing.T) { aclsService := service.NewAccessControlsService(service.AccessControlServiceInput{ Log: log, Config: &cfg, + Runtime: &runtime, LabelProvider: nil, }) diff --git a/internal/service/access_controls_service.go b/internal/service/access_controls_service.go index 6f58fa7f..922926bd 100644 --- a/internal/service/access_controls_service.go +++ b/internal/service/access_controls_service.go @@ -66,15 +66,15 @@ func (service *AccessControlsService) getACLs(domain string, lookup func(locator normalizedDomain := service.normalizeDomain(domain) + if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain { + return nil, fmt.Errorf("domain does not match cookie domain, expected %s (or a subdomain), got %s", service.runtime.CookieDomain, domain) + } + var domainMatch *model.App var nameMatch *model.App var nameMatchedApps []string locatorFunc := func(name string, app *model.App) bool { - if !strings.HasSuffix(normalizedDomain, "."+service.runtime.CookieDomain) && normalizedDomain != service.runtime.CookieDomain { - service.log.App.Debug().Str("name", name).Msg("Domain does not match runtime cookie domain, skipping") - return false - } if app.Config.Domain != "" { if !service.ensureAscii(app.Config.Domain) { service.log.App.Warn().Str("name", name).Str("domain", app.Config.Domain).Msg("Domain contains non-ascii characters, skipping") diff --git a/internal/service/access_controls_service_test.go b/internal/service/access_controls_service_test.go index 1e773a15..c5d00b7c 100644 --- a/internal/service/access_controls_service_test.go +++ b/internal/service/access_controls_service_test.go @@ -123,6 +123,9 @@ func TestAccessControlsService(t *testing.T) { }, }, want: nil, + errorFunc: func(t *testing.T, e error) { + assert.ErrorContains(t, e, "domain does not match cookie domain") + }, }, { name: "App in domain not matching with the cookie domain should return nothing with domain matching", @@ -134,6 +137,9 @@ func TestAccessControlsService(t *testing.T) { }, }, want: nil, + errorFunc: func(t *testing.T, e error) { + assert.ErrorContains(t, e, "domain does not match cookie domain") + }, }, }