home / boundary-checklist

Boundary checklist

A matcher is not a security boundary. Run these before calling a proxy-based control sufficient.

The checklist

Copy as Markdown

  • Can I bypass the proxy by hitting the router/handler directly with a different Host header?
  • Do encoded paths (%2e%2e/, double-encoding, Unicode) reach the same handler?
  • Does the rule match trailing slashes, alternate prefixes, and case variants?
  • What happens to x-forwarded-* headers — do they get trusted?
  • Is authorisation enforced inside the route handler too, in depth?
  • Do Server Actions / RPC endpoints fall under the same assumption?

Where this comes from

This is the working short version of the thoughts post. It is meant to be copied into a ticket, a PR, or a review comment, not admired.