Oliver Kieselbach c18de5d76c fix(security): drop client-writable certificate header; bootstrap routes token-only, fail-closed ...

SecurityValidator accepted certificate bytes from X-Client-Certificate when X-ARR-ClientCert was
absent. That header is client-writable, and certificate content alone carries no proof of private-key
possession — the TLS handshake does. On platform-cert-enforced routes the fallback was unreachable,
but /api/bootstrap/* is excluded from the platform cert requirement and an EMPTY X-Bootstrap-Token
passed the function gate (Headers.Contains) while the validator treated it as no token and fell
through to the certificate stage, where the fallback header was parsed (live-verified 2026-08-29).

- Only X-ARR-ClientCert is read; the platform strips inbound copies even on excluded paths.
- IsBootstrapRoute (path prefix mirroring the exclusion entry): missing/empty token or unwired
  BootstrapSessionService => 401 before the certificate stage.
- GetBootstrapToken treats an empty header as absent; the three bootstrap functions use it.
- Tests: BootstrapRouteFailClosedTests. Docs: client-cert-tenant-binding.md transport section.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-29 20:04:04 +02:00

..

admin-identity-binding.md

feat(security): resolve admin identity bindings automatically at grant time; per-tenant bindings panel

2026-08-29 19:21:47 +02:00

app-install-duration-attempt.md

feat: app install durations measure the status-defining attempt

2026-08-21 13:40:47 +02:00

app-version-regression-radar.md

insights: app-version duration regression radar + per-version duration stats

2026-08-13 13:39:03 +02:00

business-timestamps.md

fix(backend): business timestamps survive storage migrations (OccurredUtc + RowKey decode)

2026-07-20 11:29:53 +02:00

client-cert-tenant-binding.md

fix(security): drop client-writable certificate header; bootstrap routes token-only, fail-closed

2026-08-29 20:04:04 +02:00

cloudpc-device-validation.md

distress: carry the W365 Cloud PC marker into Devices Not Registered

2026-08-07 10:52:35 +00:00

device-journeys.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

ime-msi-archive.md

fix(ime-archive): verify MSI ProductVersion and walk primary/secondary/hotfix hosts before archiving

2026-08-29 17:23:05 +02:00

lifecycle-manifests-and-session-scope.md

backend: lifecycle completeness nets + session-scope point-read + server-side dashboard search (audit P5/P6)

2026-08-13 19:29:27 +02:00

oobe-bootstrap-go-flow.md

fix code review findings

2026-07-29 10:30:47 +02:00

plan-downgrade-retention-grace.md

feat(backend): 30-day retention grace period on Pro downgrade

2026-08-22 21:00:53 +02:00

rule-regression-radar.md

feat(insights): F3 regression radar - Wilson-gated rule hit-rate drift detection (PR6)

2026-07-27 09:10:52 +02:00

send-time-frame-separation.md

feat: P14 - per-upload-batch send time separates spool delay from clock offset

2026-08-21 00:44:29 +02:00

server-actions-on-demand-diagnostics.md

docs(okf): ServerActions & on-demand diagnostics concept doc

2026-07-24 18:15:23 +02:00

session-annotations.md

annotations: tenant switcher on the overview page + GA-lane guard on the global list

2026-08-13 09:27:31 +02:00

silent-session-classification.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

table-schema-sentinel.md

feat(telemetry): startup duration metrics for backend and MCP

2026-08-23 16:04:31 +02:00

telemetry-ingest-shaping.md

infra(telemetry): DCR also drops host-emitted successful SignalR dependencies

2026-08-23 19:15:41 +02:00

tenant-activation-welcome-mail.md

feat(admin,backend): find a tenant by its notification or contact email

2026-08-27 15:41:05 +02:00

time-attribution.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

verdict-calibration.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

vulnerability-correlation-sources.md

feat(vuln): manual "Refresh NVD Cache" and "Sync EPSS" with their own last-sync lines

2026-08-29 11:57:55 +02:00