Epic: v0.21 security review follow-ups

Open
  • Is something wrong?
#558 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
8/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
express, go, nextjs, python, rust, typescript
Domain
authentication, backend, security

Research direction

This is a tracking epic, not a task: each checkbox links to a separate issue in one of the seamless-auth repositories. Pick one linked child issue that has no assignee or pull request, read its own description, and work from there. Done means that child issue's fix is merged and its box can be ticked.

Written by the indexing model from the issue text.

Description

epic P1 security v0.23

Follow-ups from the security review of the v0.21 release train: API v0.21.1, OIDC provider edge v0.1.1, @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0, and the Go, Python and Rust adapters at v0.4.0.

The review traced sign-in, token issuance and verification, the /oidc/* service surface, inbound OAuth, application notices, step-up, and each adapter's cookie, refresh, origin and proxy paths. No unauthenticated account takeover was found. Findings that need private handling are tracked separately.

Three findings repeat across adapters and should land together: the origin check on unsafe methods, the 5 second refresh replay window, and the JWKS lock held across the network fetch.

API
  • fells-code/seamless-auth-api#552 Derive hardware-bound passkey assurance from the registered credential
  • fells-code/seamless-auth-api#553 Key the application notice per-user limit on the canonical user id
  • fells-code/seamless-auth-api#554 Keep application notice text from carrying its own links and attribution
  • fells-code/seamless-auth-api#555 Enforce third_party_clients_enabled when serving and signing for existing clients
  • fells-code/seamless-auth-api#556 Harden secret responses, external delivery tokens and provider fetches outside production
  • fells-code/seamless-auth-api#557 Send owner notice kinds the adapter does not deliver
seamless-auth-server
  • fells-code/seamless-auth-server#256 Require a JSON content type on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-server#257 Detect any trust-everything proxy setting in Express before forwarding the client IP
  • fells-code/seamless-auth-server#258 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-server#259 Keep the auth server path prefix in the JWKS URL
  • fells-code/seamless-auth-server#260 Mark client credentials tokens on the resource server user and verify the ephemeral token at registration
OIDC provider edge
  • fells-code/seamless-auth-oidc-provider#39 Ask for explicit confirmation before auto-consenting a first-party native client
  • fells-code/seamless-auth-oidc-provider#40 Accept a hop count or subnet list for TRUST_PROXY
  • fells-code/seamless-auth-oidc-provider#41 Clear first-party cookies at /session/end only when the provider session had an account
  • fells-code/seamless-auth-oidc-provider#42 Match provider routes the way oidc-provider does
  • fells-code/seamless-auth-oidc-provider#43 Reload signing keys when the API rotates
  • fells-code/seamless-auth-oidc-provider#44 Remove the grant when the auth context check fails and add a JSON error handler
Go adapter
  • fells-code/seamless-auth-go#21 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-go#22 Run refresh rotation detached from the request and keep cookies on transport errors
  • fells-code/seamless-auth-go#23 Check Origin on unsafe methods whatever the SameSite setting
Python adapter
  • fells-code/seamless-auth-python#23 Raise the PyJWT floor to 2.10.1
  • fells-code/seamless-auth-python#24 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-python#25 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-python#26 Harden redirects, logout revocation and JWK use checks
Rust adapter
  • fells-code/seamless-auth-rust#24 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-rust#25 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-rust#26 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-rust#27 Keep rotated cookies on upstream errors and clear the custom pre-auth cookie on logout
Dominant language
TypeScript
Stars
2
Forks
2
Avg merge
11h 40m
Merged PRs (30d)
104

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from fells-code/seamless-auth-api

All issues in fells-code/seamless-auth-api

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.