security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

requestmeta/requestmeta.go

@@ -191,7 +191,7 @@ func parseForwardedFor(value string) ([]netip.Addr, error) {
 	result := make([]netip.Addr, 0, len(parts))
 	for _, part := range parts {
 		address, err := netip.ParseAddr(strings.TrimSpace(part))
-		if err != nil {
+		if err != nil || address.Zone() != "" {
 			return nil, ErrInvalidForwarding
 		}
 		result = append(result, address.Unmap())

requestmeta/requestmeta_test.go

@@ -56,6 +56,16 @@ func TestResolverRejectsMalformedTrustedForwarding(t *testing.T) {
 	}
 }
 
+func TestResolverRejectsForwardedIPv6Zone(t *testing.T) {
+	resolver, _ := New(Config{TrustedProxies: []netip.Prefix{netip.MustParsePrefix("127.0.0.0/8")}, Random: strings.NewReader(strings.Repeat("c", 16))})
+	request := httptest.NewRequest(http.MethodGet, "http://example.test/", nil)
+	request.RemoteAddr = "127.0.0.1:1234"
+	request.Header.Set("X-Forwarded-For", "fe80::1%eth0")
+	if _, err := resolver.Resolve(request); !errors.Is(err, ErrInvalidForwarding) {
+		t.Fatalf("err=%v", err)
+	}
+}
+
 func TestResolverRejectsAmbiguousTrustedForwarding(t *testing.T) {
 	resolver, _ := New(Config{TrustedProxies: []netip.Prefix{netip.MustParsePrefix("127.0.0.0/8")}, Random: strings.NewReader(strings.Repeat("d", 16))})
 	request := httptest.NewRequest(http.MethodGet, "http://example.test/", nil)