Repository navigation
fix(web): gate pprof behind the login - #245
Merged
Merged
Conversation
/debug/pprof was mounted unauthenticated whenever web.frontend.pprof was on: anyone could take a heap dump and read RPC credentials and keys out of it. - /debug/pprof needs the login once an auth provider is configured: a bearer header (curl, go tool pprof) or the assertoor_debug_token cookie (browser). A browser without it gets the SPA, whose gate page sets the cookie from the session (path-scoped, SameSite=Strict, <= 30 min) and reloads, or asks for a login. Tools without a token get a 401. Open mode is unchanged. - The bare /debug/pprof path redirects to the index at /debug/pprof/ instead of landing on the SPA route. - Every profile download is logged with the requesting user; the index page is not.
barnabasbusa
approved these changes
Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
/debug/pprofwas mounted fully unauthenticated wheneverweb.frontend.pprofwas enabled. Anyone who could reach the web port could take a heap dump and read RPC credentials, private keys and similar secrets out of it.Changes
/debug/pprofneeds the login once anauthProviderUrlis configured. The token is taken from theAuthorizationheader (curl,go tool pprof) or from theassertoor_debug_tokencookie (browser).web-ui/src/pages/DebugLogin.tsx, not in the nav) sets the cookie from the session (scoped to/debug/pprof,SameSite=Strict,Secureon https, at most 30 minutes or the token expiry) and reloads, or asks the user to log in. A refused token is remembered in session storage so the page cannot reload in a loop.WWW-Authenticate: Bearer. With the frontend disabled, browsers get the 401 as well./debug/pprofpath redirects to the index at/debug/pprof/instead of landing on the SPA route.Mirrors ethpandaops/buildoor@ff6081f.
Testing
pkg/web/pprof_test.go(open mode, bearer header, cookie, bad header not rescued by cookie, tool 401, browser gate, browser POST, no-gate 401), passing with-race.go build,go vet, UI typecheck, eslint and a production webpack build pass.