Security: the API debug middleware buffers the whole request body before authentication and before the handler's size limit

[leodip]

When GOIABADA_AUTHSERVER_DEBUG_API_REQUESTS is enabled, APIDebugMiddleware reads the entire request body into memory with io.ReadAll before any authentication middleware runs and before any handler installs http.MaxBytesReader. An unauthenticated request to any route under /api/v1/admin or /api/v1/account is therefore buffered in full, whatever its size, and only then rejected with a 401. The response side buffers without a bound too, through responseWriter.Write teeing into a bytes.Buffer.

APIDebugMiddleware is the first r.Use on both mounts in src/authserver/internal/server/routes.go, ahead of RequireBearerTokenScope, RequireUserBoundToken and RequireValidSession. The three handlers that do limit a body install http.MaxBytesReader inside themselves (grep -rn "MaxBytesReader" --include=*.go src/ | grep -v _test.go returns 3 hits, all in profile-picture and client-logo handlers), which is strictly after the middleware has already read it.

This is behind a flag that is off by default, which is what kept it out of #145. #145 bounds what is formatted into the log at 256 KB, but the read has already happened by then.

Fix by bounding the read in the middleware itself, with http.MaxBytesReader or an io.LimitReader, and logging a placeholder when the limit is hit. A limit in the middleware also has to leave the handler's own MaxBytesReader working, since the handler replaces r.Body afterwards.

Related: #93 is the same class on /connect/register, a different endpoint and a different code path.

[leodip]

Merged into #205, which now covers all three places the server reads unbounded input before anything bounds it: the missing MaxHeaderBytes, the DCR body, and this middleware. The detail is carried over in full, including that it is behind a flag that is off by default and that #145 bounded what is formatted rather than what is read.

Closed during a backlog consolidation pass.