harnessrouter/harnessrouter: The gateway trusted self-asserted organization headers by default when its identity mode was left unset

Summary

The gateway's identity mode (HR_IDENTITY_MODE) decides how it treats a request that carries the internal key beside a sign-in token. Left unset, it defaulted to observe, which keeps the X-Harness-Org and X-Harness-Member headers the request asserts even when the token does not verify. A console that is not in self-hosted mode attaches the internal key to every request carrying an Authorization header, so on a deployment serving several organizations that left the mode unset, a made-up token with a made-up organization header was answered as that organization.

Who is affected

Deployments of this code that run the gateway outside the published image, for more than one organization, behind a console that is not in self-hosted mode, with HR_IDENTITY_MODE unset or set to observe, from 0.4.2 up to and including 0.31.10.

A default self-hosted install is not affected: the image's entrypoint sets off, and its console pins the one organization and gives the key only to a signed-in session.

Patches

Fixed in 0.31.11. Unset, or set to anything but off or observe, the mode is now enforce: the identity comes from the verified sign-in token, and a token that does not verify is refused. observe remains available only as an explicit choice.

Workarounds

Set HR_IDENTITY_MODE=enforce on any gateway that serves more than one organization.

Credits

Reported privately by @mikannse. Our apologies for the time this report waited.