Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Roleless OAuth session can inherit a role when a matching account is created later

Open
  • Is something wrong?
#273 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@heskew is already working on this.

Since Oct 2, 2026.

Assessment

This issue has not been assessed yet.

Description

Surfaced during #231's §3 design review. It's out of scope there because it's a property of how sessions resolve over time, not of adoption-time trust.

Problem. A trusted login whose username has no matching hdb_user still gets a raw, roleless session identity. Harper sessions don't expire. So someone who controls an email today can log in once and keep that session indefinitely. If an administrator later creates an hdb_user with the same username for an unrelated reason, the held session silently inherits that user's role. Nothing checks the session's identity again when it's resolved to a role later.

Goal. A session created before its username existed as an account must not gain that account's role later. Options to evaluate in a design note:

  • Record in the session whether an account existed when it was created, along with the stable identity binding from #231 §3. Refuse role resolution when the account was created after the session, or when the binding doesn't match.
  • Don't persist a session at all for unmatched trusted logins unless the app opts in through a hook.
  • Rely on #231 §3's oauth_identities binding gate on every privileged-session path. Check whether that already covers it, or whether role resolution in core bypasses it.

Interactions.

  • #231 §1 (neutralizing sessions from before the gate).
  • #231 §3 (the binding gate).
  • Possibly core session-to-role resolution. If the fix needs core, file a linked harper issue.

Tests:

  • A roleless trusted session is created.
  • An admin then creates an hdb_user with that username.
  • The held session does not gain the role.
  • A fresh login goes through the normal adoption gate.
Dominant language
JavaScript
Stars
1
Forks
3
Avg merge
1d 11h
Merged PRs (30d)
28

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from HarperFast/oauth

All issues in HarperFast/oauth

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.