Repository navigation
feat(plugins): add loopback proxy with scope enforcement and secret stripping - #1728
Open
developerkunal wants to merge 1 commit into
Open
developerkunal wants to merge 1 commit into
developerkunal wants to merge 1 commit into
Conversation
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
developerkunal
force-pushed
the
DXCDT-2606/loopback-proxy
branch
from
October 24, 2026 15:30
9ca63e8 to
172b55b
Compare
developerkunal
force-pushed
the
DXCDT-2606/loopback-proxy
branch
2 times, most recently
from
November 2, 2026 14:31
2063021 to
3460887
Compare
…tripping - Adds internal/plugins/proxy, a per-run HTTPS proxy on 127.0.0.1 that a plugin calls with a per-run secret instead of the real token. - Denies by default: paths must be canonical and under /api/v2/, methods are allowlisted, and each call must match a rule in the scope table that one of the command's declared scopes satisfies. A denied call gets a 403 that names the missing scope. - Removes secret fields from every JSON response, rejects responses it cannot inspect, and drops request headers that are not on an allowlist. - Refreshes the token once for concurrent 401s, caps refreshes per run, bounds in-flight calls, and exposes a one-line summary of the calls it denied. - Types the scopeTable and secretFields index fields in the registry package with schema validation shared with the proxy.
developerkunal
force-pushed
the
DXCDT-2606/loopback-proxy
branch
from
November 2, 2026 19:37
3460887 to
b892768
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds
internal/plugins/proxy, which sits between a plugin process and the Auth0 Management API. A plugin never gets the real access token. It gets a random secret for the run and calls a local HTTPS proxy, which swaps in the real token on the calls it decides to forward. Nothing calls the proxy yet, so there is no user visible change.The proxy listens on
127.0.0.1on a random port with a certificate made for that run, and a plugin is pointed at it throughAUTH0_PLUGIN_DOMAINandAUTH0_PLUGIN_MANAGEMENT_TOKEN.Requests are denied by default
Hostheader must be the proxy address./api/v2/. Odd paths are rejected, never repaired, so the path that is checked is the path that is forwarded.Authorizationheader is dropped.Responses
session_expirederror.Fail closed. The proxy refuses to start if the registry index does not publish a scope table or a list of secret fields, because forwarding without either would be fail open.
Existing code. In
internal/plugins/registry,scopeTableandsecretFieldswere opaque raw JSON. They are now typed and validated. This is a deliberate change: an index with either field in any other shape is now rejected when parsed.📚 References
DXCDT-2606. Part of the plugin framework stack of 11 PRs, and it builds on the one below it (DXCDT-2603).
🔬 Testing
The new code is covered by unit tests.
📝 Checklist