From ba2e263d00b5c9985e347dad9de8916bde56cebe Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Wed, 29 Jul 2026 12:52:53 +0100 Subject: [PATCH] fix: collapse ProxyStream auth failures into one indistinguishable response --- server/internal/grpc/proxystream.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/server/internal/grpc/proxystream.go b/server/internal/grpc/proxystream.go index f3ef058..a5e80b7 100644 --- a/server/internal/grpc/proxystream.go +++ b/server/internal/grpc/proxystream.go @@ -24,7 +24,11 @@ func (s *vantageServer) ProxyStream(stream pb.Vantage_ProxyStreamServer) error { srv, err := services.ValidateAgentToken(msg.Open.ServerId, msg.Open.AgentToken) if err != nil { - return status.Error(codes.Unauthenticated, "invalid agent token") + // Deliberately identical to the claim-failure response below: a bad + // token, an unknown proxy_id, and a proxy_id belonging to another + // instance/server must be indistinguishable to the caller. + log.Printf("proxy %s (server %s): invalid agent token", msg.Open.ProxyId, msg.Open.ServerId) + return status.Error(codes.PermissionDenied, "proxy session unavailable") } if err := serveProxy(proxy.Default, msg.Open, srv.InstanceID, stream); err != nil {