Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

#9

P1: Harden auth, sessions, and invite-token handling

closed · opened by keenan 13d ago

keenan opened this 13d ago

Why

  • LoginBegin / RegisterBegin reveal whether an account exists.
  • Auth/invite/ceremony endpoints have no rate limits; ceremonyStore.put has no size cap.
  • checkCSRF can call r.ParseForm() before a body limit on Logout and on passkey JSON endpoints.
  • Invite tokens live in /invite/{token} paths and are logged by middleware/server-error logging and proxy access logs.
  • Session lookup accepts arbitrarily long cookie values and stores an unbounded User-Agent.
  • HSTS is only set when passkeys are enabled, not whenever TLS is active.

Scope

  • Add per-IP and per-account rate limits for login/register/invite/ceremony.
  • Cap the ceremony map and expire aggressively.
  • Return generic failures for unknown accounts vs accounts without passkeys.
  • Wrap r.Body with MaxBytesReader before checkCSRF; require X-Vole-CSRF on JSON endpoints; make Logout use beginPost.
  • Add Cache-Control: no-store, Pragma: no-cache, and Referrer-Policy: no-referrer to invite/auth/account pages.
  • Redact invite tokens from logs.
  • Cap session tokens at the expected length; truncate stored User-Agent.
  • Set HSTS whenever serving HTTPS.
  • Decide and document passkey clone-warning policy.

Acceptance

  • Auth endpoints are rate-limited and body-bounded.
  • Invite tokens are absent from logs.
  • dev_login cannot be triggered through a proxy.

Comments (0)

No comments yet.