upstream-error-leak
Upstream error bodies are not relayed with the credential
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain upstream-error-leak.
- pack
upstreamopt-in pack- weight
- scoredcandidate
- scope
- server (what the harness's upstream stub received from the server, and what the server printed or relayed)
- decided by
- upstreamresponse
- since
- 0.3-draft (methodology 0.3-draft)
- config keys
checks.upstream-error-leak.enabledchecks.upstream-error-leak.severityidentities.aidentities.bupstream.credential_headerupstream.kind
Probes
error-modethe stub answers every request with HTTP 500 and a body that carries the error canary and the credential header it received; the valid calls run as identity a
Settings and thresholds
Every check also takes checks.upstream-error-leak.enabled and checks.upstream-error-leak.severity; they are described once in the configuration reference.
This check has no numeric threshold.
| Key | Default | Standard | Meaning |
|---|---|---|---|
identities.a | none | not locked | Token the harness sends as caller A wherever the server config says {bearer} or {bearer:a}. null mints one per run. Set it when the server validates tokens it did not issue. ${VAR} is read from the environment. Treated as a secret: redacted in config show and in reports (flag --identity-a). |
identities.b | none | not locked | Token the harness sends as caller B ({bearer:b}). null mints one per run. Must differ from identities.a. Treated as a secret (flag --identity-b). |
upstream.credential_header | authorization | not locked | Header the upstream-credential check reads the forwarded credential from (compared case-insensitively). |
upstream.kind | none | not locked | Kind of the harness-owned upstream stub the server's backend is pointed at through {upstream}. http starts a loopback stub that records every request the server forwards (flag --upstream). null starts none. The stub needs a server Sealmark starts, and the server must use {upstream} in command, args, env, url, headers or files. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
When the backend fails, answer with a short message of your own (the status and a stable reason) and do not relay its error body: it can carry the caller's credential, internal addresses and query text.
False positives
A server that relays the raw error body is relaying the credential the stub echoed: that is what is measured. A relay of the error canary alone is evidence, not a fail.
False negatives
A server that relays only part of an error body (without the canary), or only for other tools, is not seen. A credential in a reply without the error body is the server's own echo: upstream-credential-echo grades it, not this check.