feat(config): allow self-hosted admins to bypass allowedHeaders - #45654
Open
jamietanna wants to merge 3 commits into
Open
feat(config): allow self-hosted admins to bypass allowedHeaders#45654jamietanna wants to merge 3 commits into
allowedHeaders#45654jamietanna wants to merge 3 commits into
Conversation
jamietanna
force-pushed
the
fix/validate-headers
branch
2 times, most recently
from
September 3, 2026 15:07
7cc540a to
a01edff
Compare
In a similar way to how `allowedEnv` works, we should allow a self-hosted admin to specify whichever headers they wish in their `hostRules` - whether in their global config, a `repositories[]` entry, or a preset a `repositories[]` entry extends. Previously, this would require a self-hosted admin to add any header they wished to set to `allowedHeaders`, which would also allow any of their users' repositories to set that same header. We can align this behaviour with `allowedEnv`, which makes sure that the admin's own `headers` are always applied regardless of `allowedHeaders`, while a repository's own `hostRules` - and those of any preset it extends - remain constrained by it as before. We do not currently allow an `extends` (without a `repositories[]` entry) to bypass, and they'll be followed-up with in #45670. Co-Authored-By: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io> Co-Authored-By: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
jamietanna
force-pushed
the
fix/validate-headers
branch
from
September 3, 2026 15:10
a01edff to
9f89623
Compare
jamietanna
marked this pull request as ready for review
September 3, 2026 15:10
secustor
reviewed
Sep 6, 2026
| For more details on this syntax see Renovate's [string pattern matching documentation](./string-pattern-matching.md). | ||
|
|
||
| !!! note | ||
| `allowedHeaders` constrains what a repository, and the presets it extends, may set - it does not constrain you, the self-hosted administrator. |
Member
There was a problem hiding this comment.
This admonition is now bigger then actual text, we should move some info out of it
| // set as a pair with `headers`, even to `undefined`, rather than only when there are trusted headers: `findMatchingRule`'s hostType fallbacks build on `find()` with `{ ...fallbackResult, ...res }`, so `res`'s own `trustedHeaderNames` must shadow a fallback's own whenever `res.headers` does the same to a fallback's `headers` - otherwise a fallback's `trustedHeaderNames` could survive alongside `res`'s own, unrelated `headers` | ||
| // never set when `res.headers` isn't either, so a `find()` with no matching headers still returns `{}` rather than `{ trustedHeaderNames: undefined }`, which callers that check for an empty result (e.g. `isNonEmptyObject`) rely on | ||
| // tracked so that `applyHostRule`'s request-time defence-in-depth knows which of `res.headers` already bypassed `allowedHeaders` at registration as the administrator's own, and does not re-drop them | ||
| res.trustedHeaderNames = trustedHeaders |
Member
There was a problem hiding this comment.
We should only set it if trustedHeaders are there.
Contributor
Author
There was a problem hiding this comment.
As in wrapping it in an if (trustedHeaders)?
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Follow-up to #45649
In a similar way to how
allowedEnvworks, we should allow aself-hosted admin to specify whichever headers they wish in their
hostRules- whether in their global config, arepositories[]entry,or a preset a
repositories[]entry extends.Previously, this would require a self-hosted admin to add any header
they wished to set to
allowedHeaders, which would also allow any oftheir users' repositories to set that same header.
We can align this behaviour with
allowedEnv, which makes sure that theadmin's own
headersare always applied regardless ofallowedHeaders,while a repository's own
hostRules- and those of any preset itextends - remain constrained by it as before.
We do not currently allow an
extends(without arepositories[]entry) to bypass, and they'll be followed-up with in #45670.
Context
Please select one of the following:
AI assistance disclosure
Did you use AI tools to create any part of this pull request?
Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.
Use of AI in replying to PR comments
Who answers review comments:
Documentation (please check one with an [x])
How I've tested my work (please select one)
I have verified these changes via:
The public repository: