[PR #4] [MERGED] fix(proxy): remove internal ID headers from proxy responses #6

New issue

Closed

opened 2026-03-02 05:12:30 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 05:12:30 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/gotempsh/temps/pull/4
Author: @dviejokfs
Created: 2/16/2026
Status: ✅ Merged
Merged: 2/16/2026
Merged by: @dviejokfs

Base: main ← Head: feat/remove-internal-id-response-headers

📝 Commits (1)

6768f6d fix(proxy): remove internal ID headers from proxy responses

📊 Changes

2 files changed (+19 additions, -11 deletions)

View changed files

📝 README.md (+19 -1)
📝 crates/temps-proxy/src/proxy.rs (+0 -10)

📄 Description

Summary

Remove X-Project-ID, X-Environment-ID, and X-Deployment-ID headers from proxy responses — these leaked sequential internal integer IDs to end users, enabling enumeration and exposing potential IDOR attack surface
Preserve X-Request-ID for request tracing — operators can correlate with server-side logs for full routing context
Update README to add transactional email + DKIM and MCP server features to the feature matrix

Security

The removed headers exposed internal database IDs (sequential integers) on every proxied response. This allowed external observers to:

Enumerate how many projects/environments/deployments exist
Track growth rate over time
Potentially use IDs for IDOR attacks against any endpoint that accepts these IDs

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/gotempsh/temps/pull/4 **Author:** [@dviejokfs](https://github.com/dviejokfs) **Created:** 2/16/2026 **Status:** ✅ Merged **Merged:** 2/16/2026 **Merged by:** [@dviejokfs](https://github.com/dviejokfs) **Base:** `main` ← **Head:** `feat/remove-internal-id-response-headers` --- ### 📝 Commits (1) - [`6768f6d`](https://github.com/gotempsh/temps/commit/6768f6dcbb81e3b800783b891943b5322ffbae14) fix(proxy): remove internal ID headers from proxy responses ### 📊 Changes **2 files changed** (+19 additions, -11 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+19 -1) 📝 `crates/temps-proxy/src/proxy.rs` (+0 -10) </details> ### 📄 Description ## Summary - **Remove `X-Project-ID`, `X-Environment-ID`, and `X-Deployment-ID`** headers from proxy responses — these leaked sequential internal integer IDs to end users, enabling enumeration and exposing potential IDOR attack surface - **Preserve `X-Request-ID`** for request tracing — operators can correlate with server-side logs for full routing context - **Update README** to add transactional email + DKIM and MCP server features to the feature matrix ## Security The removed headers exposed internal database IDs (sequential integers) on every proxied response. This allowed external observers to: - Enumerate how many projects/environments/deployments exist - Track growth rate over time - Potentially use IDs for IDOR attacks against any endpoint that accepts these IDs --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>