API token principal not bound to the minting caller
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- csharp
- Domain
- authentication, backend, security
Research direction
Read the core token record write paths, especially the create chain and the owner's commit point for routed updates and data changes. Compare those paths with ApiTokenVerdict and Plugins ApiTokenService.Validate, which read the token principal. Done means new tokens can name only their writer (with the stated service token exception), existing principals cannot change, and a regression fails on current main.
Written by the indexing model from the issue text.
Description
Summary
An API token's principal (ApiToken.UserId, which every token verdict authenticates as) is not bound to the caller that writes the token record. A write path that lets a person set or change that field lets the token authenticate as a principal the writer is not.
Scope
- Core: the write seams for token records (create chain, and the owner's commit point for routed updates and data changes).
- Both token verdicts read the principal from the record: core
ApiTokenVerdictand the PluginsApiTokenService.Validate. A write-side binding covers both.
Fix
A token's principal is bound to its writer: a new token may name only the writer (service tokens only from inside their own service token namespace), and an existing token's principal never changes. The binding is enforced at the create chain and at the commit point, and it recognises the credential by its content rather than by the node type. Fix PR to follow, with a regression that fails on current main.
Not established
Whether this was ever used is not known. Tokens already in stores were not audited for a principal that differs from their partition.
- Dominant language
- C#
- Stars
- 12
- Forks
- 5
- Avg merge
- 5h 37m
- Merged PRs (30d)
- 959
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Systemorph/MeshWeaver
-
bug ci-template-feed sev:M
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Systemorph/MeshWeaver#7660 ·
Maintainers usually reply within 1 day
-
chore ci-artifact-store-miss sev:M
Difficulty 4/5 3-5 days Newbie friendliness 44/100
Systemorph/MeshWeaver#7656 ·
Maintainers usually reply within 1 day
-
bug sev:H
Difficulty 4/5 1-2 days Newbie friendliness 25/100
Systemorph/MeshWeaver#7654 ·
Maintainers usually reply within 1 day
-
GitSync: an Ignore pattern added after the first import leaves the imported nodes in place, and on a one-way Space nobody can remove themPossibly taken @rbuergi claimed this today. Openenhancement feature:gitsync-ownership feature:node-delete sev:M
Difficulty 5/5 Over a week Newbie friendliness 35/100
Systemorph/MeshWeaver#7611 ·
Maintainers usually reply within 1 day
-
Mesh teardown leaves mail module generations loaded — one lease still held on Mail.MicrosoftGraph and Mail.GmailPossibly taken @rbuergi claimed this today. Openbug sev:L
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Systemorph/MeshWeaver#7577 · 2 comments ·
Maintainers usually reply within 1 day
All issues in Systemorph/MeshWeaver
Similar issues
-
possible bug
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Include host.wslc.internal in the HTTPS development certificatePossibly taken @afscrome claimed this today. Openarea-commandlinetools
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
dotnet/aspnetcore#70122 · 1 comment ·
Maintainers usually reply within 1 day
-
:1st_place_medal: good first issue :cowboy_hat_face: refactor :roller_coaster: enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
ApplETS/Backend-Hello#78 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 2 days
-
status/triage
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Altinn/altinn-studio#21642 ·
Maintainers usually reply within 1 day