[PM-41325] feat: Add custom header support for self-hosted environments - #2925
Open
jalenfran wants to merge 2 commits into
Open
[PM-41325] feat: Add custom header support for self-hosted environments#2925jalenfran wants to merge 2 commits into
jalenfran wants to merge 2 commits into
Conversation
Allow configuring custom HTTP headers on the pre-auth self-hosted environment screen, applied to every request sent to the environment's hosts. Supports reverse proxies that gate access on a header, such as Cloudflare Access. - Store header values in the Keychain; only an opaque identifier is persisted in EnvironmentURLData, mirroring the mTLS fingerprint - Inject headers via a request handler in the HTTPServiceBuilder chain, scoped to environment hosts so credentials never reach third parties - Apply headers to icon requests in CipherIconImageLoader, which bypasses the HTTPService pipeline - Reference-count Keychain cleanup across accounts and on logout
…alues Fixes three credential-hygiene gaps shared by the mTLS client certificate and custom headers features: - Selecting a built-in region now removes Keychain credentials (client certificate identity, custom headers) whose pre-auth references were dropped by replacing the self-hosted environment URLs, instead of orphaning them. Removal is reference-counted, so credentials still used by an account remain. - Account deletion now cleans up the account's client certificate and custom headers, matching logout. Cleanup failures are logged without blocking local account removal, since the server-side deletion has already succeeded. - OSLogHTTPLogger now redacts the values of headers not on a known-safe allow-list, so authorization tokens, cookies, and user-configured custom headers no longer reach the unified log verbatim.
Collaborator
|
Thank you for your contribution! We've added this to our internal tracking system for review. Details on our contribution process can be found here: https://contributing.bitwarden.com/contributing/pull-requests/community-pr-process. |
bitwarden-bot
changed the title
jalenfran
changed the title
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎟️ Tracking
Community feature request: Allow custom header for the Bitwarden app (Android, iOS)
📔 Objective
Allow users to configure custom HTTP headers on the pre-auth Self-Hosted environment screen,
applied to every request sent to the environment's hosts. This supports self-hosted deployments
behind reverse proxies that gate access on a header — most commonly Cloudflare Access
(
CF-Access-Client-Id/CF-Access-Client-Secret) — as a lighter-weight alternative to mTLS.The implementation deliberately mirrors the existing mTLS client-certificate feature:
(
AfterFirstUnlockThisDeviceOnly). Only an opaque UUID identifier is persisted inEnvironmentURLData, exactly like the certificate fingerprint. The identifier is shared acrossaccounts pointing at the same environment, with reference-counted Keychain cleanup.
CustomHeadersRequestHandlerruns in theHTTPServiceBuilderchain.It is host-scoped: headers are only attached when the request host matches one of the
environment's hosts, so credentials are never sent to third parties (e.g. HIBP).
CipherIconImageLoaderbypassesHTTPService, so it attaches the headers itself —the same dual-path treatment mTLS required.
values are masked with a reveal toggle like other credential fields.
The second commit fixes three pre-existing credential-hygiene patterns shared with mTLS,
found while auditing the feature:
credentials (client certificate identity and custom headers) whose pre-auth references were
dropped, instead of orphaning them.
deleteAccountnow cleans up the account's client certificate and custom headers,matching
logout.OSLogHTTPLoggernow redacts the values of headers not on a known-safe allow-list, soauthorization tokens, cookies, and user-configured custom headers no longer reach the
unified log verbatim.
📸 Screenshots
Custom headers section on the Self-Hosted environment screen: