Apply review follow-ups for server-side auction hardening

- Stop forwarding client-supplied X-Forwarded-For to Prebid Server;
  synthesize it from the platform-attested client IP instead
- Make the APS slot ID remapping request-scoped by threading the
  AuctionRequest through parse_response_with_context, removing the
  shared provider-instance mutex that concurrent auctions could race
- Guard dispatch_auction against multi-provider fan-out on platforms
  whose HTTP client executes requests sequentially, mirroring
  run_providers_parallel
- Reject negative and non-finite creative-opportunity floor prices at
  config validation
- Re-run the Set-Cookie cache-privacy downgrade after operator response
  headers are applied so configured Set-Cookie plus public cache
  headers cannot produce a shared-cacheable response
- Install Prebid user ID modules immediately when the bundle loads
  after window.load (slim-Prebid lazy path), with a once-only listener
- Drop allow-same-origin from debug ADM fallback iframes and validate
  extracted iframe src schemes to http(s) only

Author: prk-Jr

crates/trusted-server-core/src/auction/orchestrator.rs

@@ -276,7 +276,12 @@ impl AuctionOrchestrator {
             // /__ts/page-bids must match or mediated cache bids lose the metadata
             // needed for creative rendering and win/billing beacons.
             let mediator_resp = mediator
-                .parse_response_with_context(platform_resp, response_time_ms, &mediator_context)
+                .parse_response_with_context(
+                    platform_resp,
+                    response_time_ms,
+                    request,
+                    &mediator_context,
+                )
                 .await
                 .change_context(TrustedServerError::Auction {
                     message: format!("Mediator {} parse failed", mediator.provider_name()),
@@ -546,7 +551,12 @@ impl AuctionOrchestrator {
                         // parallel (`/auction`, page-bids) and collect (publisher)
                         // paths. The default impl delegates to `parse_response`.
                         match provider
-                            .parse_response_with_context(response, response_time_ms, context)
+                            .parse_response_with_context(
+                                response,
+                                response_time_ms,
+                                request,
+                                context,
+                            )
                             .await
                         {
                             Ok(auction_response) => {
@@ -764,6 +774,23 @@ impl AuctionOrchestrator {
             return None;
         }
 
+        // Mirror run_providers_parallel: reject multi-provider fan-out before
+        // any request launches when the platform executes `send_async` eagerly
+        // (e.g. Cloudflare Workers, Spin). Sequential execution would accrue
+        // the sum of provider latencies before the origin fetch and then fail
+        // collection with empty bids.
+        if provider_names.len() > 1 && !context.services.http_client().supports_concurrent_fanout()
+        {
+            log::warn!(
+                "{} auction providers configured, but this platform's HTTP client \
+                 executes requests sequentially — skipping initial-page auction \
+                 dispatch; configure a single provider, or use an adapter with \
+                 concurrent fan-out support",
+                provider_names.len(),
+            );
+            return None;
+        }
+
         let auction_start = Instant::now();
         let mut backend_to_provider: HashMap<String, (String, Instant, Arc<dyn AuctionProvider>)> =
             HashMap::new();
@@ -939,6 +966,7 @@ impl AuctionOrchestrator {
                             .parse_response_with_context(
                                 platform_response,
                                 response_time_ms,
+                                &request,
                                 context,
                             )
                             .await
@@ -1082,6 +1110,7 @@ impl AuctionOrchestrator {
                                         .parse_response_with_context(
                                             platform_resp,
                                             response_time_ms,
+                                            &request,
                                             &mediator_context,
                                         )
                                         .await
@@ -1355,6 +1384,7 @@ mod tests {
             &self,
             _response: PlatformResponse,
             response_time_ms: u64,
+            _request: &AuctionRequest,
             _context: &AuctionContext<'_>,
         ) -> Result<AuctionResponse, Report<TrustedServerError>> {
             // Context-aware path: restores nurl/ad_id from the collected SSP bids.
@@ -1959,6 +1989,70 @@ mod tests {
         });
     }
 
+    #[test]
+    fn dispatch_auction_skips_multi_provider_fanout_on_sequential_platform() {
+        futures::executor::block_on(async {
+            // Arrange: two configured providers on a platform whose HTTP
+            // client executes send_async eagerly (no concurrent fan-out).
+            // The initial-page dispatch path must apply the same guard as
+            // run_providers_parallel or the summed provider latency lands
+            // before the origin fetch.
+            let stub = Arc::new(StubHttpClient::new());
+            stub.set_concurrent_fanout(false);
+            let stub_for_assertion = Arc::clone(&stub);
+
+            let services = build_services_with_http_client(stub);
+            // SAFETY: `Box::leak` creates a `'static` reference for test use only.
+            // The leaked allocation is bounded to the test process lifetime.
+            let services: &'static RuntimeServices = Box::leak(Box::new(services));
+
+            let config = AuctionConfig {
+                enabled: true,
+                providers: vec!["provider-a".to_string(), "provider-b".to_string()],
+                timeout_ms: 2000,
+                mediator: None,
+                ..Default::default()
+            };
+            let mut orchestrator = AuctionOrchestrator::new(config);
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-a",
+                backend: "backend-a",
+            }));
+            orchestrator.register_provider(Arc::new(StubAuctionProvider {
+                name: "provider-b",
+                backend: "backend-b",
+            }));
+
+            let request = create_test_auction_request();
+            let settings = create_test_settings();
+            let req = http::Request::builder()
+                .method(http::Method::GET)
+                .uri("https://example.com/test")
+                .body(edgezero_core::body::Body::empty())
+                .expect("should build request");
+            let context = AuctionContext {
+                settings: &settings,
+                request: &req,
+                timeout_ms: 2000,
+                provider_responses: None,
+                services,
+            };
+
+            // Act
+            let dispatched = orchestrator.dispatch_auction(&request, &context).await;
+
+            // Assert: no dispatch and no provider request launched.
+            assert!(
+                dispatched.is_none(),
+                "should skip initial-page dispatch on sequential platforms"
+            );
+            assert!(
+                stub_for_assertion.recorded_backend_names().is_empty(),
+                "should not launch any provider request on a sequential platform"
+            );
+        });
+    }
+
     #[test]
     fn test_apply_floor_prices_drops_bids_with_undecoded_price() {
         // Bids that reach apply_floor_prices with `price=None` cannot have a

crates/trusted-server-core/src/auction/provider.rs

@@ -49,11 +49,13 @@ pub trait AuctionProvider: Send + Sync {
         response_time_ms: u64,
     ) -> Result<AuctionResponse, Report<TrustedServerError>>;
 
-    /// Parse the response with access to the original auction context.
+    /// Parse the response with access to the original auction request and context.
     ///
     /// Providers that need request-local metadata while transforming responses
-    /// can override this method. The default preserves the existing
-    /// response-only provider contract.
+    /// can override this method. `request` is the [`AuctionRequest`] the
+    /// orchestrator dispatched, so request-scoped data (e.g. slot ID mappings)
+    /// can be derived here instead of stored on the shared provider instance.
+    /// The default preserves the existing response-only provider contract.
     ///
     /// # Errors
     ///
@@ -62,9 +64,10 @@ pub trait AuctionProvider: Send + Sync {
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
+        request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
-        let _ = context;
+        let _ = (request, context);
         self.parse_response(response, response_time_ms).await
     }
 

crates/trusted-server-core/src/creative_opportunities.rs

@@ -143,6 +143,18 @@ impl CreativeOpportunitySlot {
             format.validate_runtime(&self.id)?;
         }
 
+        // A negative floor silently disables minimum-price enforcement, and a
+        // non-finite floor (NaN/infinity) produces surprising all-pass/all-drop
+        // comparisons and an invalid OpenRTB `bidfloor`.
+        if let Some(floor_price) = self.floor_price {
+            if !floor_price.is_finite() || floor_price < 0.0 {
+                return Err(format!(
+                    "slot `{}` floor_price must be a finite value >= 0.0, got {floor_price}",
+                    self.id
+                ));
+            }
+        }
+
         // An explicit empty/whitespace `div_id` override is rejected: the
         // injected JS resolves slots with `candidate.id.startsWith(slot.div_id)`,
         // and every element id starts with the empty string, so an empty override
@@ -568,6 +580,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn validate_runtime_rejects_invalid_floor_prices() {
+        let mut slot = make_slot("atf", vec!["/"]);
+        slot.compile_patterns();
+
+        slot.floor_price = Some(-0.01);
+        assert!(
+            slot.validate_runtime("1234").is_err(),
+            "negative floor_price should fail validation"
+        );
+
+        slot.floor_price = Some(f64::NAN);
+        assert!(
+            slot.validate_runtime("1234").is_err(),
+            "NaN floor_price should fail validation"
+        );
+
+        slot.floor_price = Some(f64::INFINITY);
+        assert!(
+            slot.validate_runtime("1234").is_err(),
+            "infinite floor_price should fail validation"
+        );
+
+        slot.floor_price = Some(0.0);
+        assert!(
+            slot.validate_runtime("1234").is_ok(),
+            "zero floor_price should pass validation"
+        );
+
+        slot.floor_price = None;
+        assert!(
+            slot.validate_runtime("1234").is_ok(),
+            "absent floor_price should pass validation"
+        );
+    }
+
     #[test]
     fn to_ad_slot_wires_aps_params_into_bidders() {
         let mut slot = make_slot("atf", vec!["/"]);

crates/trusted-server-core/src/integrations/adserver_mock.rs

@@ -497,6 +497,7 @@ impl AuctionProvider for AdServerMockProvider {
         &self,
         response: PlatformResponse,
         response_time_ms: u64,
+        _request: &AuctionRequest,
         context: &AuctionContext<'_>,
     ) -> Result<AuctionResponse, Report<TrustedServerError>> {
         // Rebuild the SSP-bid lookup from the orchestrator-provided bidder