aiceflower opened a new pull request, #5457: URL: https://github.com/apache/linkis/pull/5457
## Summary The `dataworkcloud_inner_request=true` cookie was client-controllable yet treated as a trusted signal to skip server-side session expiry checks. This PR adds source IP validation so only requests from trusted internal sources (gateway / same-network peers) can trigger the bypass. Gateway entry point (`GatewaySSOUtils.getLoginUser`) no longer accepts the cookie-based fallback at all — the gateway is the external trust boundary. The header-based `OTHER_SYSTEM_IGNORE_UM_USER` path is also gated behind the same IP check. ## Changes - `SecurityFilter.isRequestIgnoreTimeout`: cookie check + IP allowlist (default loopback + RFC1918) - `SecurityFilter.getLoginUserThrowsExceptionWhenTimeout`: header fallback also requires trusted IP - `GatewaySSOUtils.getLoginUser`: removed cookie fallback, only header-based `OTHER_SYSTEM_IGNORE_UM_USER` - New config: `linkis.security.trusted.internal.sources` (CIDRs, default 127.0.0.1/RFC1918) - New config: `linkis.security.ignore.timeout.require.internal.ip` (default true, escape hatch) ## Affected files - `linkis-commons/linkis-module/.../SecurityFilter.scala` (+66/-14) - `linkis-spring-cloud-services/.../GatewaySSOUtils.scala` (+13/-14) ## Deployment impact | Scenario | Impact | |---|---| | Gateway → backend forwarding | No impact (Gateway IP in RFC1918) | | Direct backend access (no Gateway) | May need IP allowlist config | | Gateway on public IP | Add Gateway IP to trusted sources | | Kubernetes | RFC1918 covers pod IPs | 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
