Skip to content

fix(people): reapply bounded header authority after confirmed-hire authentication #334

Description

@seonghobae

Canonical owner: PR #55 confirmed-hire transport boundary.

#333 bounded the pre-authentication Authorization header collection, but HireAcceptanceAsgiApp re-reads scope["headers"] after awaiting the authenticator for Idempotency-Key and Content-Type. Test-first 909a1f139a34140c5c30cd3cdd292133f11c8aeb proves an exact post-auth replacement can exceed 16 KiB before body consumption. Repair ceef8e74adf9d7416af6eafce54be897c0161ef4 adds _bounded_hire_headers(...), revalidating exact containers/scalars plus the canonical 64-header, per-pair 16 KiB and aggregate 16 KiB budgets before post-auth semantic scans.

#335/#336/#337 subsequently advance the same canonical owner without weakening this transport repair. Current #55 exact head is 947ecf15b5a0e1d88758a2fdc118ce0157034e0b; descendants are #149 73464ddfe9b3563a717919ff8dabf7b36b5d9c44, #155 e164a2d046972ea0d6bfb138734c19bfae3084ff, #156 5f508c28b253db2b89bd854435da38c437182a49.

Current exact-head runs: Foundation 34858404911, Security 34858404825, SAST 34858404605, CodeQL 34858404718, all queued at the latest sweep. No predecessor GREEN/review transfer and no hosted GREEN is claimed. Keep open until protected exact-head acceptance/integration.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions