feat(auth-v2): Use HTTP Header to protect endpoints on production

[leedongwei]

Depends on #94390.

[cursor]

Bug: Default Secret Vulnerability

The AUTH_V2_SECRET defaults to an empty string. In production, if left unconfigured, this allows an attacker to bypass authentication by sending an empty X-Sentry-Auth-V2 header, as the permission check "" == "" evaluates to True. Additionally, the comment Protect login/registration endpoints during development phase is misleading, as the AuthV2Permission logic enforces protection in production (when IS_DEV is False), not during development.

src/sentry/conf/server.py#L650-L652

sentry/src/sentry/conf/server.py

Lines 650 to 652 in a2f257e

	# Protect login/registration endpoints during development phase
	AUTH_V2_SECRET = ""

src/sentry/auth_v2/endpoints/base.py#L12-L14

sentry/src/sentry/auth_v2/endpoints/base.py

Lines 12 to 14 in a2f257e

	secret = request.META.get("HTTP_X_SENTRY_AUTH_V2")
	return secret == settings.AUTH_V2_SECRET

Fix in Cursor

---

Was this report helpful? Give feedback by reacting with 👍 or 👎

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #94588      +/-   ##
==========================================
- Coverage   81.67%   80.35%   -1.32%     
==========================================
  Files       10406    10406              
  Lines      602542   602542              
  Branches    23448    23448              
==========================================
- Hits       492117   484181    -7936     
- Misses     109673   117609    +7936     
  Partials      752      752