conductor/SLICE4.md

Slice 4: Proxy Security

Status

Not started

Objective

Harden the REST proxy against unsafe destinations, header abuse, credential leakage, and resource exhaustion while retaining backend-agnostic REST support.

Dependencies

• Slice 3 credential injection and redaction model
• Existing proxy response contract and deployment configuration

In Scope

• Destination policy, SSRF defenses, request controls, sanitized observability, and execution history

Out of Scope

• Application RBAC, enterprise SIEM integration, and arbitrary user scripting

Tasks

• Document the proxy threat model and default-deny boundaries.
• Define permitted origins, hosts, schemes, and ports.
• Block unsafe local, link-local, metadata-service, and unapproved destinations.
• Revalidate DNS results and redirect targets.
• Permit only HTTP and HTTPS.
• Allowlist request headers and strip dangerous or hop-by-hop headers.
• Add request, response, redirect, and timeout limits.
• Standardize safe proxy error responses.
• Persist sanitized execution metadata and bounded previews.
• Add execution-history retrieval for troubleshooting.
• Add adversarial and regression tests.
• Update state, deployment, and security documentation.

Acceptance Criteria

• Forbidden destinations cannot be reached directly or through DNS/redirect bypasses.
• Credentials cannot be forwarded to unintended origins.
• Unsafe headers and oversized traffic are rejected predictably.
• Logs and history remain useful without containing secrets.
• Approved external and internal APIs work through explicit policy.

Validation

• Backend TypeScript check passes.
• Proxy security, SSRF, redirect, timeout, and size-limit tests pass.
• Docker Compose policy configuration is verified.

Risks and Open Questions

• Internal enterprise APIs require an explicit exception to private-network blocking.
• Redirects and DNS resolution need validation at each boundary.
• Execution previews need strict redaction and size limits.

Progress Log

No work recorded yet.

Handoff

• Last completed: Slice plan created.
• Next action: Define destination-policy configuration and threat-model tests.
• Known blockers: Decide how approved internal hosts are represented.