From 5e1e23e209eec75a396c18f8eee3d93a9e196bfc Mon Sep 17 00:00:00 2001
From: Dan Engelbrecht <dan.engelbrecht@epicgames.com>
Date: Tue, 17 Feb 2026 14:00:53 +0100
Subject: add http server root password protection (#757)

- Feature: Added `--security-config-path` option to zenserver to configure security settings
  - Expects a path to a .json file
  - Default is an empty path resulting in no extra security settings and legacy behavior
  - Current support is a top level filter of incoming http requests restricted to the `password` type
  - `password` type will check the `Authorization` header and match it to the selected authorization strategy
  - Currently the security settings is very basic and configured to a fixed username+password at startup

        {
            "http" {
                "root": {
                    "filter": {
                        "type": "password",
                        "config": {
	                          "password": {
	                              "username": "<username>",
	                              "password": "<password>"
	                          },
                            "protect-machine-local-requests": false,
	                          "unprotected-uris": [
	                              "/health/",
	                              "/health/info",
	                              "/health/version"
	                          ]
                        }
                    }
                }
            }
        }
---
 src/zenhttp/servers/httpsys.cpp | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

(limited to 'src/zenhttp/servers/httpsys.cpp')

diff --git a/src/zenhttp/servers/httpsys.cpp b/src/zenhttp/servers/httpsys.cpp
index 5fed94f1c..14896c803 100644
--- a/src/zenhttp/servers/httpsys.cpp
+++ b/src/zenhttp/servers/httpsys.cpp
@@ -72,6 +72,8 @@ GetAddressString(StringBuilderBase& OutString, const SOCKADDR* SockAddr, bool In
 	OutString.Append("unknown");
 }
 
+class HttpSysServerRequest;
+
 /**
  * @brief Windows implementation of HTTP server based on http.sys
  *
@@ -102,7 +104,7 @@ public:
 	inline bool IsOk() const { return m_IsOk; }
 	inline bool IsAsyncResponseEnabled() const { return m_IsAsyncResponseEnabled; }
 
-	IHttpRequestFilter::Result FilterRequest(HttpServerRequest& Request);
+	IHttpRequestFilter::Result FilterRequest(HttpSysServerRequest& Request);
 
 private:
 	int	 InitializeServer(int BasePort);
@@ -319,7 +321,8 @@ public:
 	virtual Oid		 ParseSessionId() const override;
 	virtual uint32_t ParseRequestId() const override;
 
-	virtual bool IsLocalMachineRequest() const;
+	virtual bool			 IsLocalMachineRequest() const;
+	virtual std::string_view GetAuthorizationHeader() const override;
 
 	virtual IoBuffer ReadPayload() override;
 	virtual void	 WriteResponse(HttpResponseCode ResponseCode) override;
@@ -1364,6 +1367,7 @@ HttpSysServer::OnRun(bool IsInteractive)
 
 				if (c == 27 || c == 'Q' || c == 'q')
 				{
+					m_ShutdownEvent.Set();
 					RequestApplicationExit(0);
 				}
 			}
@@ -1861,6 +1865,14 @@ HttpSysServerRequest::IsLocalMachineRequest() const
 	}
 }
 
+std::string_view
+HttpSysServerRequest::GetAuthorizationHeader() const
+{
+	const HTTP_REQUEST*		 HttpRequestPtr		 = m_HttpTx.HttpRequest();
+	const HTTP_KNOWN_HEADER& AuthorizationHeader = HttpRequestPtr->Headers.KnownHeaders[HttpHeaderAuthorization];
+	return std::string_view(AuthorizationHeader.pRawValue, AuthorizationHeader.RawValueLength);
+}
+
 IoBuffer
 HttpSysServerRequest::ReadPayload()
 {
@@ -2270,7 +2282,7 @@ HttpSysServer::OnSetHttpRequestFilter(IHttpRequestFilter* RequestFilter)
 }
 
 IHttpRequestFilter::Result
-HttpSysServer::FilterRequest(HttpServerRequest& Request)
+HttpSysServer::FilterRequest(HttpSysServerRequest& Request)
 {
 	if (!m_HttpRequestFilter.load())
 	{
@@ -2282,8 +2294,7 @@ HttpSysServer::FilterRequest(HttpServerRequest& Request)
 	{
 		return IHttpRequestFilter::Result::Accepted;
 	}
-	IHttpRequestFilter::Result FilterResult = RequestFilter->FilterRequest(Request);
-	return FilterResult;
+	return RequestFilter->FilterRequest(Request);
 }
 
 Ref<HttpServer>
-- 
cgit v1.2.3