# Slice 4: Proxy Security

## Status

Not started

## Objective

Harden the REST proxy against unsafe destinations, header abuse, credential leakage, and resource exhaustion while retaining backend-agnostic REST support.

## Dependencies

- Slice 3 credential injection and redaction model
- Existing proxy response contract and deployment configuration

## In Scope

- Destination policy, SSRF defenses, request controls, sanitized observability, and execution history

## Out of Scope

- Application RBAC, enterprise SIEM integration, and arbitrary user scripting

## Tasks

- [ ] Document the proxy threat model and default-deny boundaries.
- [ ] Define permitted origins, hosts, schemes, and ports.
- [ ] Block unsafe local, link-local, metadata-service, and unapproved destinations.
- [ ] Revalidate DNS results and redirect targets.
- [ ] Permit only HTTP and HTTPS.
- [ ] Allowlist request headers and strip dangerous or hop-by-hop headers.
- [ ] Add request, response, redirect, and timeout limits.
- [ ] Standardize safe proxy error responses.
- [ ] Persist sanitized execution metadata and bounded previews.
- [ ] Add execution-history retrieval for troubleshooting.
- [ ] Add adversarial and regression tests.
- [ ] Update state, deployment, and security documentation.

## Acceptance Criteria

- [ ] Forbidden destinations cannot be reached directly or through DNS/redirect bypasses.
- [ ] Credentials cannot be forwarded to unintended origins.
- [ ] Unsafe headers and oversized traffic are rejected predictably.
- [ ] Logs and history remain useful without containing secrets.
- [ ] Approved external and internal APIs work through explicit policy.

## Validation

- [ ] Backend TypeScript check passes.
- [ ] Proxy security, SSRF, redirect, timeout, and size-limit tests pass.
- [ ] Docker Compose policy configuration is verified.

## Risks and Open Questions

- Internal enterprise APIs require an explicit exception to private-network blocking.
- Redirects and DNS resolution need validation at each boundary.
- Execution previews need strict redaction and size limits.

## Progress Log

No work recorded yet.

## Handoff

- Last completed: Slice plan created.
- Next action: Define destination-policy configuration and threat-model tests.
- Known blockers: Decide how approved internal hosts are represented.