M6: Reject non-loopback gRPC bind addresses; consolidated auth-coverage canary #240

Merged

KofTwentyTwo merged 1 commits from story/m6-grpc-bind-hardening into dev

2026-07-30 16:25:32 +00:00

Author	SHA1	Message	Date
James Maes	ea12bbd8b6	feat(security): reject non-loopback gRPC bind addresses serve() now parses the requested address and rejects it with a new GrpcServeError::NonLoopbackAddress before ever calling TcpListener::bind, so a misconfigured NUNCIO_GRPC_ADDR can't expose the bearer-token-only API beyond the local host. Also adds one consolidated canary test that dials all eight mounted services with no token and asserts Unauthenticated, giving reviewers a single checkpoint to update whenever a service is added to serve_on_listener_with_overrides. Refs #201	2026-07-29 22:26:55 -05:00

Author

SHA1

Message

Date

James Maes

ea12bbd8b6

feat(security): reject non-loopback gRPC bind addresses

serve() now parses the requested address and rejects it with a new
GrpcServeError::NonLoopbackAddress before ever calling TcpListener::bind,
so a misconfigured NUNCIO_GRPC_ADDR can't expose the bearer-token-only
API beyond the local host. Also adds one consolidated canary test that
dials all eight mounted services with no token and asserts
Unauthenticated, giving reviewers a single checkpoint to update whenever
a service is added to serve_on_listener_with_overrides.

Refs #201

2026-07-29 22:26:55 -05:00