Epic: v0.21 security review follow-ups

Abierto
  • ¿Algo no está bien?
#558 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
8/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
express, go, nextjs, python, rust, typescript
Área
authentication, backend, security

Línea de trabajo

This is a tracking epic, not a task: each checkbox links to a separate issue in one of the seamless-auth repositories. Pick one linked child issue that has no assignee or pull request, read its own description, and work from there. Done means that child issue's fix is merged and its box can be ticked.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

epic P1 security v0.23

Follow-ups from the security review of the v0.21 release train: API v0.21.1, OIDC provider edge v0.1.1, @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0, and the Go, Python and Rust adapters at v0.4.0.

The review traced sign-in, token issuance and verification, the /oidc/* service surface, inbound OAuth, application notices, step-up, and each adapter's cookie, refresh, origin and proxy paths. No unauthenticated account takeover was found. Findings that need private handling are tracked separately.

Three findings repeat across adapters and should land together: the origin check on unsafe methods, the 5 second refresh replay window, and the JWKS lock held across the network fetch.

API
  • fells-code/seamless-auth-api#552 Derive hardware-bound passkey assurance from the registered credential
  • fells-code/seamless-auth-api#553 Key the application notice per-user limit on the canonical user id
  • fells-code/seamless-auth-api#554 Keep application notice text from carrying its own links and attribution
  • fells-code/seamless-auth-api#555 Enforce third_party_clients_enabled when serving and signing for existing clients
  • fells-code/seamless-auth-api#556 Harden secret responses, external delivery tokens and provider fetches outside production
  • fells-code/seamless-auth-api#557 Send owner notice kinds the adapter does not deliver
seamless-auth-server
  • fells-code/seamless-auth-server#256 Require a JSON content type on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-server#257 Detect any trust-everything proxy setting in Express before forwarding the client IP
  • fells-code/seamless-auth-server#258 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-server#259 Keep the auth server path prefix in the JWKS URL
  • fells-code/seamless-auth-server#260 Mark client credentials tokens on the resource server user and verify the ephemeral token at registration
OIDC provider edge
  • fells-code/seamless-auth-oidc-provider#39 Ask for explicit confirmation before auto-consenting a first-party native client
  • fells-code/seamless-auth-oidc-provider#40 Accept a hop count or subnet list for TRUST_PROXY
  • fells-code/seamless-auth-oidc-provider#41 Clear first-party cookies at /session/end only when the provider session had an account
  • fells-code/seamless-auth-oidc-provider#42 Match provider routes the way oidc-provider does
  • fells-code/seamless-auth-oidc-provider#43 Reload signing keys when the API rotates
  • fells-code/seamless-auth-oidc-provider#44 Remove the grant when the auth context check fails and add a JSON error handler
Go adapter
  • fells-code/seamless-auth-go#21 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-go#22 Run refresh rotation detached from the request and keep cookies on transport errors
  • fells-code/seamless-auth-go#23 Check Origin on unsafe methods whatever the SameSite setting
Python adapter
  • fells-code/seamless-auth-python#23 Raise the PyJWT floor to 2.10.1
  • fells-code/seamless-auth-python#24 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-python#25 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-python#26 Harden redirects, logout revocation and JWK use checks
Rust adapter
  • fells-code/seamless-auth-rust#24 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-rust#25 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-rust#26 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-rust#27 Keep rotated cookies on upstream errors and clear the custom pre-auth cookie on logout
Lenguaje dominante
TypeScript
Estrellas
2
Forks
2
Merge medio
11 h 40 min
PR fusionados (30 d)
104

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de fells-code/seamless-auth-api

Todos los issues de fells-code/seamless-auth-api

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.