security: Prevent session hijacking through a malicious notebook.

[sven-ernw]

✏️ Summary of Changes

This pull request addresses the security issue described in GHSA-qjw6-hpc7-w36h together with the notebook's pull request !562. It prevents session hijacking through a malicious notebook.

This will be achieved by the following changes:

• Add an EnvoyFilter envoy-filter-gateway.yaml in the oauth2-proxy overlay that strips the authenticating cookie from requests before it is forwarded to backend services like a malicious notebook. This prevents malicious notebooks from accessing other users' authentication credentials. This solution was discussed with @thesuperzapper during a Notebooks WG meeting.
• Add a description of how to set up the multi-domain support for notebooks in proposals/20260705-secure-notebook-setup.md and the configuration parameter (disabled by default). This setup is required because even without authentication credentials, an attacker can control the user agent (browser) through a malicious notebook to make requests to the Kubeflow APIs.
• Add a Security Considerations section which describes important security measures for a secure production setup.

📦 Dependencies

• The notebook's pull request !562 is required to make the described multi-domain setup work. However, the multi-domain setup is not enabled by default. So, this change will not break any existing functionality even if !562 is not released.

🐛 Related Issues

• GitHub Security advisory GHSA-qjw6-hpc7-w36h

✅ Contributor Checklist

• I have tested these changes with kustomize. See Installation Prerequisites.
• All commits are signed-off to satisfy the DCO check.
• I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.). (Answer: No, bc we are not adopters but independent security researchers and consultants.)

CC: @lorinl @thesuperzapper @juliusvonkohout

[github-actions]

Welcome to the Kubeflow Community Distribution Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronized from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/community-distribution to test the platform integration.

Community Resources:

• CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
• Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

[Copilot]

Pull request overview

This pull request hardens Kubeflow notebook access against session hijacking.

Changes:

• Adds gateway cookie filtering.
• Documents production security and multi-domain notebook configuration.
• Adds notebook-controller subdomain parameters.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 16 comments.

Show a summary per file

File	Description
README.md	Adds production security guidance.
proposals/20260705-secure-notebook-setup.md	Documents multi-domain notebook setup.
common/oauth2-proxy/README.md	Documents cookie-name coupling.
common/oauth2-proxy/base/oauth2_proxy.cfg	Adds subdomain cookie guidance.
common/istio/istio-install/overlays/oauth2-proxy/kustomization.yaml	Includes the gateway filter.
common/istio/istio-install/overlays/oauth2-proxy/envoy-filter-gateway.yaml	Filters the session cookie.
applications/notebooks-v1/upstream/notebook-controller/manager/params.env	Adds subdomain parameters.
applications/notebooks-v1/upstream/notebook-controller/manager/manager.yaml	Injects the parameters into the controller.

[sven-ernw]

Addressed all comments from Copilot.

[sven-ernw]

/assign @juliusvonkohout

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 15 comments.

[thesuperzapper]

/ok-to-test

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from juliusvonkohout. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sven-ernw]

@thesuperzapper I have reviewed and fixed all suggestions from the CoPilot review.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

proposals/20260705-secure-notebook-setup.md:100

• Remove the duplicated word section.

This will make the setup work. Please ensure that you follow the recommendations in the [_Security Considerations_ section](../README.md#security-considerations) section for guidance on a secure setup.

[sven-ernw]

Fixed all feedback from review, pull request can be merged once kubeflow/notebooks#562 is merged.