fix(server): prevent /debug/* exposure via DefaultServeMux fallthrough
Closed
MA
4mo ago+139+139+012345678901234567890123456789-2-2-0123456789
Summary
Kratos HTTP servers route unmatched requests to http.DefaultServeMux through their NotFoundHandler and MethodNotAllowedHandler. Standard-library packages such as net/http/pprof, expvar and golang.org/x/net/trace auto-register handlers on that global mux from their init() functions, so any unmatched route on a public server could leak /debug/pprof/*, /debug/vars and /debug/requests.
This adds a shared DenyDefaultMuxFallthrough helper that returns plain 404/405 handlers, severing the fallthrough on every network path, and applies it to the Control Plane and Artifact CAS HTTP and metrics servers. Registered routes continue to be matched by the router and are unaffected.