s3: verify X-Forwarded-Prefix only from trusted proxies (#11843)

* s3api: check the direct peer against the trusted-proxy allowlist

* s3: verify X-Forwarded-Prefix only from trusted proxies

* s3: note that trusted proxies must sanitize forwarded headers

weed/command/scaffold/security.toml

@@ -232,11 +232,14 @@ kek = ""
 # Cannot be used while /etc/s3/sse_kek exists on the filer — delete it first.
 key = ""
 
-# Trusted reverse proxies allowed to set X-Forwarded-For / X-Real-Ip for
-# aws:SourceIp condition evaluation in S3 bucket and IAM policies. When the
-# direct TCP peer is in this list, forwarded headers are honored; otherwise
-# the direct peer address is used (matching AWS S3 semantics). Leave empty to
-# always use the direct peer, which is the safe default.
+# Trusted reverse proxies allowed to set forwarding headers on behalf of the
+# real client: X-Forwarded-For / X-Real-Ip for aws:SourceIp condition
+# evaluation in S3 bucket and IAM policies, and X-Forwarded-Prefix for SigV4
+# signature verification of prefix-stripped paths. When the direct TCP peer is
+# in this list, these headers are honored; otherwise they are ignored. A
+# trusted proxy must overwrite or strip client-supplied values of these
+# headers, since honoring them means trusting them. Leave empty to always use
+# the direct peer, which is the safe default.
 # Can also be set via env var: WEED_S3_TRUSTED_PROXIES_WHITE_LIST
 [s3.trusted_proxies]
 white_list = "" # comma separated; bare IPs or CIDRs, e.g. "10.10.10.0/24"