🛡️ Sentinel: [HIGH] Fix auth bypass

[xbmc4lyfe]

🚨 Severity: HIGH
💡 Vulnerability: The loopback proxy authentication check (_prepare_token_ok in stream_proxy_handler_dispatch.py) evaluated if expected_token and not compare(...). If expected_token was empty, the if block was bypassed entirely, returning True.
🎯 Impact: Fails-open authentication allows unauthenticated attackers (e.g. malicious local scripts or cross-site requests to localhost if CORS permitted) to interact with the local proxy loopback endpoints and hijack/control streaming behavior.
🔧 Fix: Verified the secret is explicitly populated first (if not expected_token: return False) before performing hmac.compare_digest.
✅ Verification: Ran the full pytest suite ensuring all 2620 tests continue to pass and confirmed the local fix via script output (empty/empty combinations correctly yield False).

---

PR created automatically by Jules for task 12958361526875688762 started by @xbmc4lyfe

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest

The overall coverage in commit fa93d50 in the sentinel-fix-auth-by... branch remains at 88%, unchanged from commit c8dfe60 in the main branch.