Repository navigation
fix(proxy): prevent "Value not set" errors on startup and add authentication support to misp-guard - #465
Merged
ostefano merged 5 commits intoOct 15, 2026
Conversation
misp-guard authentication - Enable blank_protection for proxy settings in proxy.envars.json to avoid CakePHP "Value not set" rejection on empty credentials - Add Proxy.password to sensitive_settings in utilities.sh to prevent leaking plain text credentials in logs - Add GUARD_USER and GUARD_PASSWORD to misp-guard environment and entrypoint with mitmdump --proxyauth support - Update template.env, docker-compose.yml, and README.md with proxy authentication guidance
Contributor
|
Reproduced #464 and the For the feature, this was possible before with @ostefano I built and tested locally. Once my changes are merged in, this should be good to go IMO. |
guard: pass through PROXY_ creds, single mitim call
Contributor
Author
|
Hi @monjiapawne and @ostefano, I've merged the changes from @monjiapawne's PR and added one final documentation improvement to Could you please review and validate this PR when you have a moment? Thanks! |
ostefano
approved these changes
Oct 15, 2026
Collaborator
|
LGTM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #464
Summary of Changes
Fix
misp-corestartup errors with unauthenticated proxy (Value not set/Setting change rejected):"blank_protection": trueto all entries incore/files/etc/misp-docker/proxy.envars.json.PROXY_METHOD,PROXY_USER,PROXY_PASSWORD) are empty or unset,enforce_env_settingssafely skips them instead of attempting to enforce empty strings ('') that CakePHP setting validation rejects.Added proxy credential support for
misp-guard:guard/files/entrypoint.shto check forGUARD_USERandGUARD_PASSWORD, dynamically appending--proxyauth=${GUARD_USER}:${GUARD_PASSWORD}to themitmdumpexecution call when configured.GUARD_USERandGUARD_PASSWORDindocker-compose.ymlunder themisp-guardservice, keeping clean separation between proxy client settings (PROXY_*) and proxy daemon settings (GUARD_*).Masked proxy password in logs:
Proxy.passwordtosensitive_settingsincore/files/utilities.shso passwords are masked as<hidden>during startup whenDISABLE_PRINTING_PLAINTEXT_CREDENTIALS=true.Documentation & Template Updates:
template.envandREADME.mdto documentGUARD_USERandGUARD_PASSWORD.PROXY_USERandPROXY_PASSWORDmust matchGUARD_USERandGUARD_PASSWORD.PROXY_METHOD(e.g.Basic) must be set for MISP to send credentials to the proxy.