Restrict OpenAI gateway endpoint to internal network after detecting unauthorized external probes #70

New Issue
Open
opened 2026-07-13 00:37:05 +02:00 by retoor · 21 comments
retoor commented 2026-07-13 00:37:05 +02:00
Owner
Copy Link

Summary

The OpenAI gateway log shows two rejected connection attempts from external sources, indicating the /openai/v1/chat/completions endpoint is publicly reachable. External parties are actively probing for open/leaked LLM endpoints. One rejected call had a latency of 12335ms, meaning a full connection was held open before rejection.

Steps to Reproduce

  1. Review the OpenAI gateway log for rejected connection attempts from external sources.
  2. Observe entries such as: 
    [22:31:02] Rejected POST /chat/completions: unauthorized
[22:31:11] Rejected POST /chat/completions: unauthorized
  3. Note that the endpoint is publicly reachable and external probes are occurring.

Expected Behaviour

The /openai/v1/chat/completions endpoint should not be publicly reachable. It should be restricted to internal network access only (127.0.0.1/localhost), as all internal services already use localhost URLs.

Actual Behaviour

The endpoint is publicly reachable, and external unauthorized connection attempts are being logged. One rejected call had a latency of 12335ms, indicating a full connection was held open before rejection.

Environment

Not provided.

Reported by retoor via DevPlace.

## Summary The OpenAI gateway log shows two rejected connection attempts from external sources, indicating the `/openai/v1/chat/completions` endpoint is publicly reachable. External parties are actively probing for open/leaked LLM endpoints. One rejected call had a latency of 12335ms, meaning a full connection was held open before rejection. ## Steps to Reproduce 1. Review the OpenAI gateway log for rejected connection attempts from external sources. 2. Observe entries such as: ``` [22:31:02] Rejected POST /chat/completions: unauthorized [22:31:11] Rejected POST /chat/completions: unauthorized ``` 3. Note that the endpoint is publicly reachable and external probes are occurring. ## Expected Behaviour The `/openai/v1/chat/completions` endpoint should not be publicly reachable. It should be restricted to internal network access only (127.0.0.1/localhost), as all internal services already use localhost URLs. ## Actual Behaviour The endpoint is publicly reachable, and external unauthorized connection attempts are being logged. One rejected call had a latency of 12335ms, indicating a full connection was held open before rejection. ## Environment Not provided. --- *Reported by **retoor** via DevPlace.*
plan-ticket-70.md
6.2 KiB
plan-ticket-70.md
2.9 KiB
plan-ticket-70.md
4.6 KiB
typosaurus commented 2026-07-20 00:31:45 +02:00
Collaborator
Copy Link

I am picking this ticket up now.

First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.

I am picking this ticket up now. First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.
typosaurus commented 2026-07-20 00:32:03 +02:00
Collaborator
Copy Link

Starting research round 1 of at most 5.

I am now reading the relevant source, tests, and prior work in the live checkout to verify the ticket and gather the context needed for a concrete plan. This can take a while; I will post periodic progress updates until it completes.

Starting research round 1 of at most 5. I am now reading the relevant source, tests, and prior work in the live checkout to verify the ticket and gather the context needed for a concrete plan. This can take a while; I will post periodic progress updates until it completes.
typosaurus commented 2026-07-20 00:34:13 +02:00
Collaborator
Copy Link

The ticket was compared against the current source and tests. The findings show that the requested restriction—limiting the OpenAI gateway to internal network access—is already implemented in two independent layers (Python middleware and nginx), with unit tests verifying the behavior. The ticket description appears to match an earlier version of the codebase rather than the current state.

Could you confirm whether the ticket description is still accurate, or should it be closed as already implemented?

The ticket was compared against the current source and tests. The findings show that the requested restriction—limiting the OpenAI gateway to internal network access—is already implemented in two independent layers (Python middleware and nginx), with unit tests verifying the behavior. The ticket description appears to match an earlier version of the codebase rather than the current state. Could you confirm whether the ticket description is still accurate, or should it be closed as already implemented?
typosaurus commented 2026-07-23 01:15:49 +02:00
Collaborator
Copy Link

I am picking this ticket up now.

First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.

I am picking this ticket up now. First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.
typosaurus commented 2026-07-23 01:16:37 +02:00
Collaborator
Copy Link

I need input to continue.

What I tried: Retried this step 3 times.
What I found: Each attempt failed for internal reasons unrelated to this ticket. The details are in the operator's logs; this is not a judgment about the ticket.

The system needs operator attention before I can continue. Reply here once things are healthy and I will resume from where I left off.

I need input to continue. What I tried: Retried this step 3 times. What I found: Each attempt failed for internal reasons unrelated to this ticket. The details are in the operator's logs; this is not a judgment about the ticket. The system needs operator attention before I can continue. Reply here once things are healthy and I will resume from where I left off.
typosaurus commented 2026-07-23 01:57:19 +02:00
Collaborator
Copy Link

I am picking this ticket up now.

First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.

I am picking this ticket up now. First I will bring up an isolated workspace with a fresh checkout and investigate whether the ticket matches the current state of the code before planning any change. I will announce every step here before I take it.
typosaurus commented 2026-07-23 01:57:38 +02:00
Collaborator
Copy Link

Starting research round 1 of at most 5.

I am now reading the relevant source, tests, and prior work in the live checkout to verify the ticket and gather the context needed for a concrete plan. This can take a while; I will post periodic progress updates until it completes.

Starting research round 1 of at most 5. I am now reading the relevant source, tests, and prior work in the live checkout to verify the ticket and gather the context needed for a concrete plan. This can take a while; I will post periodic progress updates until it completes.
typosaurus commented 2026-07-23 02:00:02 +02:00
Collaborator
Copy Link

Investigated the ticket against the current source and tests. The issue is confirmed: the /openai/v1/chat/completions endpoint is publicly reachable on master with only application-level authentication, and external probes are visible in logs. A two-layer fix (nginx + Python middleware) already exists on the feature branch typosaurus/ticket-70 and has not been merged.

The problem is well-understood and actionable. Next step is drafting a concrete implementation plan for merging the fix.

Investigated the ticket against the current source and tests. The issue is confirmed: the `/openai/v1/chat/completions` endpoint is publicly reachable on `master` with only application-level authentication, and external probes are visible in logs. A two-layer fix (nginx + Python middleware) already exists on the feature branch `typosaurus/ticket-70` and has not been merged. The problem is well-understood and actionable. Next step is drafting a concrete implementation plan for merging the fix.
typosaurus commented 2026-07-23 02:02:34 +02:00
Collaborator
Copy Link

I am drafting the implementation plan now.

The research confirmed the ticket; I am turning the findings into a concrete, verifiable plan.

I am drafting the implementation plan now. The research confirmed the ticket; I am turning the findings into a concrete, verifiable plan.
typosaurus commented 2026-07-23 02:03:17 +02:00
Collaborator
Copy Link

Implementation plan drafted from the investigation findings. The plan covers merging the two-layer IP restriction fix from typosaurus/ticket-70 into master, resolving the known merge conflicts in five files by discarding unintended changes from the ticket branch, addressing the pre-existing test failure in tests/unit/content.py, and running the full verification suite.

The plan is now being handed to the execution agent for implementation. No further action is required on this ticket at this time.

Implementation plan drafted from the investigation findings. The plan covers merging the two-layer IP restriction fix from `typosaurus/ticket-70` into `master`, resolving the known merge conflicts in five files by discarding unintended changes from the ticket branch, addressing the pre-existing test failure in `tests/unit/content.py`, and running the full verification suite. The plan is now being handed to the execution agent for implementation. No further action is required on this ticket at this time.
typosaurus commented 2026-07-23 02:03:19 +02:00
Collaborator
Copy Link

The full, verbatim implementation plan is attached: plan-ticket-70.md

The full, verbatim implementation plan is attached: [plan-ticket-70.md](https://retoor.molodetz.nl/attachments/92438f2d-7b3f-44a3-a973-87ad9bce6272)
typosaurus commented 2026-07-23 02:13:31 +02:00
Collaborator
Copy Link

Starting implementation attempt 1 of at most 5.

I am executing the plan inside this ticket's isolated workspace. This can take a while; I will post periodic progress updates until it completes.

Starting implementation attempt 1 of at most 5. I am executing the plan inside this ticket's isolated workspace. This can take a while; I will post periodic progress updates until it completes.
typosaurus commented 2026-07-23 02:23:32 +02:00
Collaborator
Copy Link

Progress update: implementation attempt 1 is still running (10 minutes elapsed). I have not stalled; I will report the result here the moment this step completes.

Progress update: implementation attempt 1 is still running (10 minutes elapsed). I have not stalled; I will report the result here the moment this step completes.
typosaurus commented 2026-07-23 02:25:42 +02:00
Collaborator
Copy Link

Implementation attempt 1 finished; I am verifying it now.

Running the project's own build, test, and lint commands against the change.

Implementation attempt 1 finished; I am verifying it now. Running the project's own build, test, and lint commands against the change.
typosaurus commented 2026-07-23 02:26:52 +02:00
Collaborator
Copy Link

Attempt 1 did not succeed because the change failed to apply cleanly or did not pass the project’s own checks, specifically the test_command validation. The next attempt will incorporate the recorded failure details and lessons from the prompt, targeting a cleaner application and successful validation.

Attempt 1 did not succeed because the change failed to apply cleanly or did not pass the project’s own checks, specifically the test_command validation. The next attempt will incorporate the recorded failure details and lessons from the prompt, targeting a cleaner application and successful validation.
typosaurus commented 2026-07-23 02:27:58 +02:00
Collaborator
Copy Link

Starting implementation attempt 2 of at most 5.

I am executing the plan inside this ticket's isolated workspace. This can take a while; I will post periodic progress updates until it completes.

Starting implementation attempt 2 of at most 5. I am executing the plan inside this ticket's isolated workspace. This can take a while; I will post periodic progress updates until it completes.
typosaurus commented 2026-07-23 02:37:58 +02:00
Collaborator
Copy Link

Progress update: implementation attempt 2 is still running (10 minutes elapsed). I have not stalled; I will report the result here the moment this step completes.

Progress update: implementation attempt 2 is still running (10 minutes elapsed). I have not stalled; I will report the result here the moment this step completes.
typosaurus commented 2026-07-23 02:45:37 +02:00
Collaborator
Copy Link

Implementation attempt 2 finished; I am verifying it now.

Running the project's own build, test, and lint commands against the change.

Implementation attempt 2 finished; I am verifying it now. Running the project's own build, test, and lint commands against the change.
typosaurus commented 2026-07-23 02:46:53 +02:00
Collaborator
Copy Link

Attempt 2 did not succeed due to checks failing on test_command. The change either did not apply cleanly or did not meet the project's validation requirements.

The next attempt will incorporate the recorded failure details and adjustments based on previous findings.

Attempt 2 did not succeed due to checks failing on test_command. The change either did not apply cleanly or did not meet the project's validation requirements. The next attempt will incorporate the recorded failure details and adjustments based on previous findings.
typosaurus commented 2026-07-23 02:51:24 +02:00
Collaborator
Copy Link

A conflict appeared while rebasing onto master; I am resolving it now.

Handing the conflicting files to the execution agent for one resolution attempt.

A conflict appeared while rebasing onto `master`; I am resolving it now. Handing the conflicting files to the execution agent for one resolution attempt.
typosaurus commented 2026-07-23 02:52:41 +02:00
Collaborator
Copy Link

The ticket branch was rebased onto master and the automated merge attempted to resolve the conflict, but the overlapping changes could not be reconciled automatically. The divergence appears to involve logic that both branches modified in incompatible ways, leaving no clear path for a mechanical resolution.

How should these conflicting changes be reconciled?

The ticket branch was rebased onto `master` and the automated merge attempted to resolve the conflict, but the overlapping changes could not be reconciled automatically. The divergence appears to involve logic that both branches modified in incompatible ways, leaving no clear path for a mechanical resolution. How should these conflicting changes be reconciled?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
No items
No Label
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: retoor/devplacepy#70
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?