# Security & boundaries

Source: https://gortexa.sheng.page/en/examples/security/

## 03 security-probe — rejection paths leak nothing

Adversarial input across all three protocols, asserting no error body carries internal detail.

```bash
# missing/bad/expired token → 401 UNAUTHENTICATED
curl -H "authorization: Bearer xxx" http://localhost:18080/v1/resources        # 401

# evil origin → response carries no Access-Control-Allow-Origin
curl -D - -H "Origin: https://evil.example" http://localhost:18080/v1/resources

# >1 MiB body to /mcp → 413, clean
curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \
  --data-binary @big.json                                                       # 413

# bad version / unknown tool / huge id / not-JSON → structured JSON-RPC error, no panic
curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"no_such_tool","arguments":{}}}'
```

A final scan over every rejection body asserts no stack traces, internal paths, or unmasked causes.

## 06 config-matrix — JWT secret startup safety

A placeholder or too-short secret is refused at startup (fail-loud), and the error never echoes the secret itself.

```bash
GORTEXA_AUTH__JWT_SECRET="dev-only-insecure-secret-change-me-please" ./server   # exit 1, no port bound
GORTEXA_AUTH__JWT_SECRET='tooshort' ./server                                    # exit 1
GORTEXA_AUTH__JWT_SECRET="<45-byte real secret>" ./server                       # starts; env overrides file secret
```

Rejection happens before listen, so (a) and (b) never bind a port.

## 08 header-leak-probe — response header allowlist

Response headers stay within a fixed allowlist: no `Grpc-Metadata-*` passthrough, while `X-Request-Id` must survive (the allowlist must not overshoot).

```bash
curl -D - -H "authorization: Bearer $TOK" http://localhost:18082/v1/resources/x
# asserts: no grpc-metadata-* headers, nothing outside the allowlist, X-Request-Id present
```

## 09 reflection-probe — reflection off by default, config-gated

gRPC reflection is off by default; the same call succeeds only once it is enabled via env.

```bash
buf curl --protocol grpc --http2-prior-knowledge --reflect ...   # default: fails (service not found)
GORTEXA_SERVER__REFLECTION=true ./server
buf curl --protocol grpc --http2-prior-knowledge --reflect ...   # enabled: succeeds
```

Keep it off in production — see the production flags in [Deployment](https://gortexa.sheng.page/en/deployment/).