Web app: serve it from its own origin, so other pages on mostro.network cannot read its storage
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 32/100
Research direction
Review the discussion in #651 and the issue's origin and storage constraints first. Then trace the hosting setup for the app, /protocol/, and /docs-english/, along with the web app's storage entry point. Done means the web app is isolated at its own origin, users of the old path see a migration notice, and native apps remain unaffected.
Written by the indexing model from the issue text.
Description
The web app shares its origin with the rest of mostro.network: the main site, /protocol/ and /docs-english/. The two docs sites load their own scripts.
Browsers isolate storage per origin, not per path. So any script on those pages can read what the app keeps in localStorage: the mnemonic today, and the NWC secret once #650 lands. flutter_secure_storage does not change that on web, because its AES key sits in the same localStorage as the ciphertext. One bad script in the docs is enough to take a user's keys.
I'd suggest serving the app from an origin of its own, like app.mostro.network, with nothing else on it.
The cost: storage does not move along. Existing web users start empty and restore with their mnemonic, so the old path needs a short notice. Native apps are not affected; they use Keychain and Keystore.
Raised by @grunch in the review of #651.
- Dominant language
- Dart
- Stars
- 11
- Forks
- 9
- Avg merge
- 20h 36m
- Merged PRs (30d)
- 236
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from MostroP2P/app
-
area: ui feature priority: medium
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
area: rust-core bug priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
area: ui
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
AimesSoft/NipaPlay-Reload#1022 ·
Maintainers usually reply within 1 day
-
`jwtPayload.roomConfiguration` returns null fields for tokens from LiveKit server SDKsPossibly taken @RaphaelFakhri claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
livekit/client-sdk-flutter#1243 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
maplibre/flutter-maplibre-gl#1094 ·
Maintainers usually reply within 1 day
-
bug to check
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
zjs81/meshcore-open#602 · 3 comments ·
Maintainers usually reply within 1 day