security: fix critical issues (open proxy SSRF, weak default password, permissive CORS)

[devin-ai-integration]

Summary

Security review of the RVG Gateway (main.py, in-memory FastAPI app). Fixed the critical issues; remaining lower-severity items are listed below for follow-up.

Fixed (critical / high)

1. Unauthenticated open proxy + SSRF — /proxy/{target_url:path} had no auth and forwarded requests to any host. Anyone could use the server as an open forward proxy and reach internal services / cloud metadata (e.g. 169.254.169.254, 127.0.0.1). Now requires a valid session (Depends(require_auth)) and rejects non-public targets:

   # resolve host, block private/loopback/link-local/reserved/multicast IPs
   if not _is_public_host(parsed.hostname):
       raise HTTPException(403, "Access to internal or non-public hosts is not allowed")

   Also set follow_redirects=False on the proxied request so a redirect can't bounce into an internal address after the check.

2. Weak default admin password — AUTH defaulted to ADMIN_PASSWORD or the hardcoded "123456". Anyone could log in to an unconfigured deployment. Now a random one-time password is generated (and logged) when ADMIN_PASSWORD is unset; the guessable default is removed.

3. Overly permissive CORS — allow_origins=["*"] combined with allow_credentials=True lets any website make credentialed cross-origin requests. Replaced with an explicit allow-list from ALLOWED_ORIGINS (comma-separated); credentials are only enabled when specific origins are configured. Default is no cross-origin access (the dashboard is same-origin).

4. Session cookie missing Secure — login cookie is now marked Secure when the request is HTTPS (honors X-Forwarded-Proto behind Railway's proxy), so the session token isn't sent over plaintext.

5. Vulnerable dependencies — bumped fastapi 0.104.1 → 0.115.6 (fixes the form-parsing ReDoS, PYSEC-2024-38), httpx 0.25.1 → 0.27.2, uvicorn 0.24.0 → 0.32.1.

Verified

Ran the app locally: unauth /proxy → 401; login with 123456 → 401; SSRF to 169.254.169.254 and 127.0.0.1 → 403; authed proxy to a public host → 200; app imports and serves the dashboard/login normally.

Findings NOT changed (need product decision)

• Quota/link bypass in the VLESS tunnel: check_quota returns True for an unknown UUID ("backward compatibility"), so any random /ws/{uuid} is an unlimited free tunnel, bypassing the link/limit system. Left as-is since it may be intentional — recommend denying unknown UUIDs.
• Password hashing uses salted SHA-256 (a peppered fast hash) rather than a slow KDF (bcrypt/argon2). Acceptable given the pepper, but worth upgrading.
• Remaining starlette advisories require a starlette 1.x major upgrade that FastAPI does not yet support; not forced here to avoid a risky framework migration.
• No SQL injection surface (state is fully in-memory); interactive API docs already disabled (docs_url=None).

Link to Devin session: https://app.devin.ai/sessions/46a90eb393ff4a31af6d27cebcae374a
Requested by: @hmilan1366

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring