Epic: v0.21 security review follow-ups

Offen
  • Stimmt etwas nicht?
#558 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
8/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
express, go, nextjs, python, rust, typescript
Bereich
authentication, backend, security

Rechercherichtung

This is a tracking epic, not a task: each checkbox links to a separate issue in one of the seamless-auth repositories. Pick one linked child issue that has no assignee or pull request, read its own description, and work from there. Done means that child issue's fix is merged and its box can be ticked.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

epic P1 security v0.23

Follow-ups from the security review of the v0.21 release train: API v0.21.1, OIDC provider edge v0.1.1, @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0, and the Go, Python and Rust adapters at v0.4.0.

The review traced sign-in, token issuance and verification, the /oidc/* service surface, inbound OAuth, application notices, step-up, and each adapter's cookie, refresh, origin and proxy paths. No unauthenticated account takeover was found. Findings that need private handling are tracked separately.

Three findings repeat across adapters and should land together: the origin check on unsafe methods, the 5 second refresh replay window, and the JWKS lock held across the network fetch.

API
  • fells-code/seamless-auth-api#552 Derive hardware-bound passkey assurance from the registered credential
  • fells-code/seamless-auth-api#553 Key the application notice per-user limit on the canonical user id
  • fells-code/seamless-auth-api#554 Keep application notice text from carrying its own links and attribution
  • fells-code/seamless-auth-api#555 Enforce third_party_clients_enabled when serving and signing for existing clients
  • fells-code/seamless-auth-api#556 Harden secret responses, external delivery tokens and provider fetches outside production
  • fells-code/seamless-auth-api#557 Send owner notice kinds the adapter does not deliver
seamless-auth-server
  • fells-code/seamless-auth-server#256 Require a JSON content type on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-server#257 Detect any trust-everything proxy setting in Express before forwarding the client IP
  • fells-code/seamless-auth-server#258 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-server#259 Keep the auth server path prefix in the JWKS URL
  • fells-code/seamless-auth-server#260 Mark client credentials tokens on the resource server user and verify the ephemeral token at registration
OIDC provider edge
  • fells-code/seamless-auth-oidc-provider#39 Ask for explicit confirmation before auto-consenting a first-party native client
  • fells-code/seamless-auth-oidc-provider#40 Accept a hop count or subnet list for TRUST_PROXY
  • fells-code/seamless-auth-oidc-provider#41 Clear first-party cookies at /session/end only when the provider session had an account
  • fells-code/seamless-auth-oidc-provider#42 Match provider routes the way oidc-provider does
  • fells-code/seamless-auth-oidc-provider#43 Reload signing keys when the API rotates
  • fells-code/seamless-auth-oidc-provider#44 Remove the grant when the auth context check fails and add a JSON error handler
Go adapter
  • fells-code/seamless-auth-go#21 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-go#22 Run refresh rotation detached from the request and keep cookies on transport errors
  • fells-code/seamless-auth-go#23 Check Origin on unsafe methods whatever the SameSite setting
Python adapter
  • fells-code/seamless-auth-python#23 Raise the PyJWT floor to 2.10.1
  • fells-code/seamless-auth-python#24 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-python#25 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-python#26 Harden redirects, logout revocation and JWK use checks
Rust adapter
  • fells-code/seamless-auth-rust#24 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-rust#25 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-rust#26 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-rust#27 Keep rotated cookies on upstream errors and clear the custom pre-auth cookie on logout
Vorherrschende Sprache
TypeScript
Sterne
2
Forks
2
Ø Merge
11 Std. 40 Min.
Gemergte PRs (30 T.)
104

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus fells-code/seamless-auth-api

Alle Issues in fells-code/seamless-auth-api

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.