Task · MDE-0007

Enforce D9 origin-bound credential stripping

Description

PR #735 changed src/meraki_dashboard_exporter/api/client.py:24-65 to preserve Authorization across origin changes when the destination host has a Meraki-owned suffix. That resolves PR #733 P1.2 by contradicting frozen decision D9, which requires credentials to be stripped unconditionally whenever the origin changes. Restore an origin comparison based on the request origin in effect before redirect handling; same-origin explicit default ports remain equivalent, but every changed scheme, host, or port loses Authorization. Do not weaken the operator-selected custom-base-url policy.

Acceptance Criteria

Definition of Done

Implementation Plan

  1. Replace Meraki-domain suffix trust with configured-origin equality. 2. Reverse the shard-host regression test and add scheme/port boundary coverage. 3. Run the focused transport tests, then the repository gate and security review before commit.

Implementation Notes

Red proof: uv run pytest -q tests/unit/test_697_698_api_transport.py -k “697 or meraki or scheme_or_port” failed 2 tests because shard-host and non-default-port requests retained Authorization. After the implementation change the same selection passed 10 tests. CodeRabbit reviewed the staged security diff on the rknightion plan with 0 findings. Final gate: make check passed ruff, format (377 files), mypy (121 source files), and 2737 pytest tests with 1 Starlette deprecation warning.

Final Summary

Implemented configured-origin credential binding in commit 163e16bd91d19d9fd0a511bf6f805637f70f81b4. Same-origin and explicit default-port requests retain Authorization; Meraki shard hosts, lookalikes, scheme changes, and non-default ports lose it. Red proof failed the shard and port cases before the fix; focused validation passed 10 tests, CodeRabbit reported 0 findings, and make check passed 2737 tests plus ruff, format, and mypy. make docgen and Grafana edits were not applicable because no generator input, metric, or label changed.

References

View the source file on GitHub