upstream-credential-echo
Replies never contain a caller's credential
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain upstream-credential-echo.
- pack
upstreamopt-in pack- weight
- scoredcandidate
- scope
- server (what the harness's upstream stub received from the server, and what the server printed or relayed)
- decided by
- response
- since
- 0.3-draft (methodology 0.3-draft)
- config keys
checks.upstream-credential-echo.enabledchecks.upstream-credential-echo.severityidentities.aidentities.bupstream.credential_headerupstream.kind
Probes
repliesthe replies to the valid calls under identities a and b are searched for either minted token
Settings and thresholds
Every check also takes checks.upstream-credential-echo.enabled and checks.upstream-credential-echo.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
identities.a | none | not locked | Token the harness sends as caller A wherever the server config says {bearer} or {bearer:a}. null mints one per run. Set it when the server validates tokens it did not issue. ${VAR} is read from the environment. Treated as a secret: redacted in config show and in reports (flag --identity-a). |
identities.b | none | not locked | Token the harness sends as caller B ({bearer:b}). null mints one per run. Must differ from identities.a. Treated as a secret (flag --identity-b). |
upstream.credential_header | authorization | not locked | Header the upstream-credential check reads the forwarded credential from (compared case-insensitively). |
upstream.kind | none | not locked | Kind of the harness-owned upstream stub the server's backend is pointed at through {upstream}. http starts a loopback stub that records every request the server forwards (flag --upstream). null starts none. The stub needs a server Sealmark starts, and the server must use {upstream} in command, args, env, url, headers or files. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Never return the caller's credential in a reply: strip Authorization headers and token values from messages, errors and debug text before they reach a response.
False positives
None known: the tokens are random strings the harness minted for this run.
False negatives
A token echoed only for arguments the harness did not send is not seen. An encoded or truncated echo is not seen.