Security & boundaries

03 security-probe — rejection paths leak nothing

Adversarial input across all three protocols, asserting no error body carries internal detail.

# missing/bad/expired token → 401 UNAUTHENTICATED
curl -H "authorization: Bearer xxx" http://localhost:18080/v1/resources        # 401

# evil origin → response carries no Access-Control-Allow-Origin
curl -D - -H "Origin: https://evil.example" http://localhost:18080/v1/resources

# >1MB body to /mcp → 413, clean
curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \
  --data-binary @big.json                                                       # 413

# bad version / unknown tool / huge id / not-JSON → structured JSON-RPC error, no panic
curl -XPOST http://localhost:18080/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"no_such_tool","arguments":{}}}'

A final scan over every rejection body asserts no stack traces, internal paths, or unmasked causes.

06 config-matrix — JWT secret startup safety

A placeholder or too-short secret is refused at startup (fail-loud), and the error never echoes the secret itself.

GORTEXA_AUTH__JWT_SECRET="dev-only-insecure-secret-change-me-please" ./server   # exit 1, no port bound
GORTEXA_AUTH__JWT_SECRET='tooshort' ./server                                    # exit 1
GORTEXA_AUTH__JWT_SECRET="<45-byte real secret>" ./server                       # starts; env overrides file secret

Rejection happens before listen, so (a) and (b) never bind a port.

08 header-leak-probe — response header allowlist

Response headers stay within a fixed allowlist: no Grpc-Metadata-* passthrough, while X-Request-Id must survive (the allowlist must not overshoot).

curl -D - -H "authorization: Bearer $TOK" http://localhost:18082/v1/resources/x
# asserts: no grpc-metadata-* headers, nothing outside the allowlist, X-Request-Id present

09 reflection-probe — reflection off by default, config-gated

gRPC reflection is off by default; the same call succeeds only once it is enabled via env.

buf curl --protocol grpc --http2-prior-knowledge --reflect ...   # default: fails (service not found)
GORTEXA_SERVER__REFLECTION=true ./server
buf curl --protocol grpc --http2-prior-knowledge --reflect ...   # enabled: succeeds

Keep it off in production — see the production flags in Deployment.