| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix(egress): outbound url policy across all customer-controlled egress paths (#6646) ## Summary Builds on the existing base-URL denylist and the `@nangohq/egress` package to add a single, configurable outbound URL policy across all customer-controlled egress paths. Every outbound connection - including each redirect hop - is now routed through DNS-pinning agents that re-validate the *resolved* IP, with a configurable redirect cap. Secure defaults apply out of the box; behavior is tunable via `NANGO_OUTBOUND_URL_POLICY`. ## What changed **Egress policy is now applied at the leaf of each outbound path:** - **Proxy (server + runner):** `ProxyRequest` accepts an `outboundPolicy`; `getAxiosConfiguration` attaches DNS-pinning keep-alive agents, caps `maxRedirects`, and re-validates the resolved address on the initial request and on every `beforeRedirect` hop (mTLS connections included). - **Customer webhook delivery:** `deliver()` resolves an env-derived transport (policy + agents + redirect validator) by default, applies the redirect cap, and skips disallowed targets. - **`uncontrolledFetch` (runner SDK):** validates the resolved address per hop; unresolvable hostnames fall through to a normal fetch failure rather than a policy denial. - **Credential verification + AWS SigV4 hooks:** the internal `ProxyRequest` calls now carry the server policy too. - **Webhook registration (`PATCH .../webhook`):** rejects disallowed URLs at save time. **Config & propagation:** - New optional `NANGO_OUTBOUND_URL_POLICY` (JSON), parsed/validated at startup and memoized. - Propagated automatically to Kubernetes and Lambda runners. - Documented in `.env.example` and the self-hosting guide. **Performance:** safe DNS lookups and agents are memoized per-policy so connections pool and the pinned-address cache is shared across requests. <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6646?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> | 3 个月前 | |
feat: connection-level webhook url override (#6639) ### What Lets a single connection override the environment-wide webhook URLs with its own URL. Useful for routing one connection's sync/auth webhooks somewhere specific (e.g. a dev tunnel) without changing the shared environment endpoint. Works for all auth types, settable via the REST API, the connect SDK, or the dashboard's "Create connection" overrides. ### How Added `webhook_url ` to `ConnectionConfig`. This config is set at session creation time. We validate it just like the environment-level webhook urls (valid url that is not in our deny list). OAuth already merges connect-session `connection_config` defaults server-side; non-OAuth flows historically ignored them and only read request `params`. Had to tweak non-OAuth to do the same as OAuth: apply `connection_config` from the session on top of the ones from `params`. The session values intentionally override the `params`, since the session is the one created by the trusted actor. We only allow setting `webhook_url` at session creation, we ignore it from the `params` (because it's untrusted at that point). ### Usage Via sdk: ```ts const session = await nango.createConnectSession({ end_user: { id: 'user-123' }, allowed_integrations: ['my-integration'], integrations_config_defaults: { 'my-integration': { connection_config: { webhook_url: 'https://my-app.dev/nango-webhooks', webhook_url_secondary: 'https://my-app.dev/nango-webhooks-2' // optional } } } }); ``` In dashboard: <img width="1672" height="1478" alt="Kapture 2026-06-23 at 23 17 46" src="https://github.com/user-attachments/assets/e8193201-a538-420e-86f0-d67ecb645816" /> <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/NangoHQ/nango/pull/6639?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> | 3 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 3 个月前 | ||
| 3 个月前 |