- Shipped
- August 15, 2026 at 2:08 PM UTC
- Author
- kamo
- Commit
- e631efa
KamoLOS trusts X-Org-Id and X-Member-Id from this proxy. ProxyHmacFilter exists to prove those headers really came from here, but it is disabled in production: the deployment sets no LOS_PROXY_HMAC_ENABLED and no shared secret existed until now, so los.proxy-hmac.enabled falls through to false and the headers are unsigned on a live multi-tenant loan API with 15 real loans on it. The LOS route already computes the signature — it just skips when LOS_PROXY_HMAC_SECRET is absent. Mounting the new los-proxy-hmac secret is what switches signing on. This side goes first on purpose. KamoLOS ignores the signature until its own los.proxy-hmac.enabled is true, so this commit changes no behaviour anywhere; it only starts attaching X-Proxy-Signature and X-Proxy-Timestamp. Doing it the other way — validation before signing — would reject every loan request in the platform. Step 2 sets LOS_PROXY_HMAC_ENABLED=true and the same secret on kamowslos-deployment, after this rollout is confirmed.