W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard

--- description: W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard - Mandates strict ingress boundary redaction, allowlist enforcement, and HMAC cryptographic signing for W3C distributed baggage headers across multi-tenant security boundaries. Prevents untrusted external context injection, tenant spoofing, and privilege escalation via unverified OpenTelemetry propagation propagation context. globs: src/middleware/**/*.{ts,js}, src/tracing/**/*.{ts,js}, src/telemetry/**/*.{ts,js}, src/gateway/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/w3c-baggage-zero-trust-boundary-sanitization-standard" --- # W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Blind Propagation of Unverified and Unsigned W3C Baggage Across Multi-Tenant Boundaries ## System Constraints You are a Principal Security Architect enforcing the W3C Baggage Header Zero-Trust Boundary Sanitization Standard. In distributed systems using OpenTelemetry and W3C Baggage (RFC 7230 / W3C Baggage specification), context parameters like tenantId, authClaims, or tier overrides traverse service meshes. You must mandate that AI agents and engineers treat all incoming W3C baggage at perimeter gateways as completely untrusted input. Ingress gateways MUST strip or allowlist baggage keys, verify cryptographic HMAC signatures on internal inter-service boundaries, and strictly prevent downstream authorization decisions from relying on unverified baggage entries. ## Strict Guidelines - Engineers MUST ALWAYS strip all incoming W3C Baggage headers (`baggage`) at public-facing ingress gateways before propagating trace context downstream. - Engineers MUST NOT allow downstream microservices to make authorization, rate-limiting, routing, or tenant-isolation decisions directly from unverified OpenTelemetry Baggage. - Services MUST verify a cryptographic HMAC-SHA256 signature on internal baggage metadata whenever contextual attributes cross security zones. - Components NEVER pass unvalidated client-supplied query parameters, headers, or cookies directly into `propagation.setBaggage`. - Code SHOULD enforce an explicit, immutable allowlist of benign telemetry-only keys (e.g., `experiment_group`, `sampling_priority`) when baggage propagation is strictly required. ## Bad vs Good Implementations ### Ingress Baggage Sanitization & Cryptographic Signature Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The middleware extracts and propagates all incoming W3C baggage headers without perimeter verification. External attackers can inject forged tenancy or privilege metadata into tracing contexts that downstream services or logs may implicitly trust for routing or tenant partitioning. ```typescript import { Request, Response, NextFunction } from 'express'; import { propagation, context, ROOT_CONTEXT } from '@opentelemetry/api'; // VULNERABLE: Direct propagation of untrusted client-supplied baggage. // An external adversary can inject `baggage: tenantId=target-org,isAdmin=true,rateLimitTier=unlimited` export function telemetryMiddleware(req: Request, res: Response, next: NextFunction) { // Ingress blindly extracts baggage from HTTP headers into current context const extractedContext = propagation.extract(ROOT_CONTEXT, req.headers); context.with(extractedContext, () => { // Downstream services downstream will consume poisoned tenantId next(); }); } ``` #### Production Standard (Correct) > **Standard**: The secure middleware validates baggage provenance at the ingress boundary. It requires an HMAC signature for internal propagation, strips unverified external baggage, and enforces a strict allowlist of permitted keys, entirely preventing parameter injection attacks. ```typescript import { Request, Response, NextFunction } from 'express'; import { propagation, context, ROOT_CONTEXT, baggageUtils } from '@opentelemetry/api'; import { createHmac, timingSafeEqual } from 'crypto'; const ALLOWED_BAGGAGE_KEYS = new Set(['client_build_id', 'traffic_source']); const INTERNAL_HMAC_SECRET = process.env.INTERNAL_BAGGAGE_HMAC_SECRET ?? ''; function verifyInternalSignature(payload: string, signature: string): boolean { if (!INTERNAL_HMAC_SECRET || !signature) return false; const expected = createHmac('sha256', INTERNAL_HMAC_SECRET).update(payload).digest('hex'); const expectedBuf = Buffer.from(expected, 'hex'); const signatureBuf = Buffer.from(signature, 'hex'); return expectedBuf.length === signatureBuf.length && timingSafeEqual(expectedBuf, signatureBuf); } export function secureTelemetryMiddleware(req: Request, res: Response, next: NextFunction) { const isInternalService = req.headers['x-internal-perimeter-token'] !== undefined; const rawBaggage = req.headers['baggage']; const baggageSignature = req.headers['x-baggage-signature'] as string | undefined; // Strip untrusted baggage at ingress boundary unless internal and cryptographically verified if (!isInternalService || !rawBaggage || !baggageSignature || !verifyInternalSignature(String(rawBaggage), baggageSignature)) { delete req.headers['baggage']; } const extractedContext = propagation.extract(ROOT_CONTEXT, req.headers); const activeBaggage = propagation.getBaggage(extractedContext); // Build a sanitized baggage container conforming to zero-trust allowlist let sanitizedBaggage = propagation.createBaggage(); if (activeBaggage) { for (const [key, entry] of activeBaggage.getAllEntries()) { if (ALLOWED_BAGGAGE_KEYS.has(key)) { sanitizedBaggage = sanitizedBaggage.setEntry(key, entry); } } } const secureContext = propagation.setBaggage(extractedContext, sanitizedBaggage); context.with(secureContext, () => { next(); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard

W3C Baggage Header Zero-Trust Boundary Sanitization and Cryptographic Validation Standard defines an industrial-grade behavioral standard for security engineering. Mandates strict ingress boundary redaction, allowlist enforcement, and HMAC cryptographic signing for W3C distributed baggage headers across multi-tenant security boundaries. Prevents untrusted external context injection, tenant spoofing, and privilege escalation via unverified OpenTelemetry propagation propagation context. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind Propagation of Unverified and Unsigned W3C Baggage Across Multi-Tenant Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind Propagation of Unverified and Unsigned W3C Baggage Across Multi-Tenant Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS strip all incoming W3C Baggage headers (`baggage`) at public-facing ingress gateways before propagating trace context downstream.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.