andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-13 17:35:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* Add DenyLists parsing

* Remove unneeded returned error

* Plug global denylist into Command

* app creation: apply denylist to backchannel logout URI

* Inject denylist to backchannel logout worker

* webhook config: validate against blocked URLs

* Add notificationsWebhook denylist target

* command: Add SMTP endpoint validation against blocklist

* command: Add SMS endpoint validation against blocklist

* Validate webhook endpoint against denylist on channel notification

* Remove unused tests

* handle deprecated denylists

* remove unintended denylist entry in deprecated list

* use single http client

* fix tests

* update comments

* fixes

* cleanup

* address comments

* fix merge

---------

Co-authored-by: Livio Spring <[email protected]>
This commit is contained in:
Marco A.
2026-06-15 15:36:14 +02:00
committed by GitHub
co-authored by Livio Spring
parent d184e976fc
commit 8e82ec1cb9
97 changed files with 1834 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/defaults.yaml
+35 -10
View File
@@ -598,12 +598,9 @@ Executions:
MaxTtl: 5m # ZITADEL_EXECUTIONS_MAXTTL
# List of domains and IPs that are not valid execution target's endpoints
# Wildcard sub domains are currently unsupported
# Deprecated: use HTTPClient.DenyList instead. If both are set, this list will be merged into the HTTPClient.DenyList.
DenyList: # ZITADEL_EXECUTIONS_DENYLIST (comma separated list)
- localhost
- "127.0.0.0/8"
- "::1"
- "0.0.0.0"
- "::"
Auth:
# See Projections.BulkLimit
@@ -1033,12 +1030,8 @@ SystemDefaults:
Actions:
HTTP:
# Wildcard sub domains are currently unsupported
# Deprecated: use HTTPClient.DenyList instead. If both are set, this list will be merged into the HTTPClient.DenyList.
DenyList: # ZITADEL_ACTIONS_HTTP_DENYLIST (comma separated list)
- localhost
- "127.0.0.0/8"
- "::1"
- "0.0.0.0"
- "::"
LogStore:
Access:
@@ -1072,6 +1065,38 @@ Eventstore:
# Maximum amount of push retries in case of primary key violation on the sequence
MaxRetries: 5 #ZITADEL_EVENTSTORE_MAXRETRIES
HTTPClient:
# Sets the limit of the response body size in bytes, which will be processed by the HTTP client.
# If the response body exceeds this limit, the client will return an error.
# The default value is 20MB.
MaxBodySize: 20971520 # ZITADEL_HTTPCLIENT_MAXBODYSIZE
# Sets the timeout for the HTTP client.
Timeout: 30s # ZITADEL_HTTPCLIENT_TIMEOUT
# Sets the number of allowed redirects for the HTTP client.
MaxRedirects: 5 # ZITADEL_HTTPCLIENT_MAXREDIRECTS
# Specifies if the HTTP client should follow redirects from HTTPS to HTTP.
AllowHTTPSDowngrade: false # ZITADEL_HTTPCLIENT_ALLOWHTTPSDOWNGRADE
# Specifies the list of IP addresses or CIDR ranges that are not allowed to be called by the HTTP client.
# Note that hosts / domains are matched best-case and wildcards are not supported.
# CRITICAL SECURITY NOTE: Domain rules (like "localhost") protect application-layer string matches.
# Underneath, the network dialer relies exclusively on the CIDR ranges below to block resolved IPs and prevent DNS Rebinding.
# Do not remove the CIDR subnets even if a domain mapping exists.
DenyList: # ZITADEL_HTTPCLIENT_DENYLIST (comma separated list)
- localhost
- "0.0.0.0/8" # Unspecified IPv4 address range / Local network routing trick protection
- "10.0.0.0/8" # Class A private networks
- "100.64.0.0/10" # Carrier-Grade NAT space
- "127.0.0.0/8" # Loopback addresses (IPv4)
- "169.254.0.0/16" # Link-local subnets (Covers Cloud Metadata Endpoints like AWS/GCP 169.254.169.254)
- "172.16.0.0/12" # Class B private networks
- "192.168.0.0/16" # Class C private networks
- "198.18.0.0/15" # Benchmark/inter-network communication testing
- "::/128" # Unspecified IPv6 address
- "::1/128" # IPv6 loopback address
- "::ffff:0:0/96" # IPv4-mapped IPv6 addresses (Prevents IPv6 encapsulation bypasses)
- "fc00::/7" # Unique local addresses / IPv6 equivalent to private IPv4 subnets
- "fe80::/10" # Link-local addresses / IPv6 equivalent to cloud metadata subnets
# The DefaultInstance section defines the default values for each new virtual instance that is created.
# Check out https://zitadel.com/docs/concepts/structure/instance#multiple-virtual-instances for more information about virtual instances.
# For the initial setup, the default values are used to create the first instance.