OVRLab
← All publications

Verify credential-key ownership before forwarding

A new request check verifies the key material in a credential reference before the proxy uses the stored secret, alongside the existing IP controls.

OVRLabProject update2 min read

An allowed destination is only one decision

SecretProxy now verifies key ownership for credential references with the new verification metadata. Before using a resolved secret, the request path checks whether the key supplied with the reference matches the stored verifier.

Target registration controls where traffic may go. A binding controls how a credential may be inserted there. The key-ownership check adds a decision about the caller’s authority to use that credential. These checks address different parts of the request.

Check before using the secret

The verifier is derived from the supplied key with a distinct authentication purpose. A missing reference or mismatched verifier rejects the request before credential use. Both the standalone proxy and the API-side proxy path apply the check.

The change includes tests for incorrect key material and the failure paths around reference resolution. Those cases are essential: a successful authorized request only exercises the positive path through the boundary.

Layer the check into the existing controls

The verification gate works alongside the IP controls already present in the proxy. An allowed network location and a matching credential key provide different evidence, so one should not silently stand in for the other.

The rollout preserves compatibility with older records that do not yet carry verification metadata. Operators need to account for that migration state when assessing which requests receive the new check. This milestone introduces the verification mechanism; completing its coverage also depends on the stored records in a deployment.

Further reading