Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Session elevation duration is unbounded, and large values silently overflow to a past timestamp

Open
  • Is something wrong?
#1,051 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@piyush295 is already working on this.

Since Sep 28, 2026.

  • #1058 by @piyush295 — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
api, authentication, security

Research direction

Start with ElevateRequest.DurationSeconds in model/elevate.go, then inspect the elevation paths at api/client.go:128 and api/oidc.go:186. Add validation that rejects values above the chosen ceiling and verify both endpoints return 400 for excessive and overflow-prone durations instead of accepting them.

Written by the indexing model from the issue text.

Description

a:bug

ElevateRequest.DurationSeconds (model/elevate.go) is only validated as non-zero, and both elevation paths multiply it straight into a time.Duration:

  • api/client.go:128 — POST /client/:id/elevate
  • api/oidc.go:186 — the OIDC elevation callback

Two consequences, both reproduced on v3.1.1:

1. Elevation can be made effectively permanent. One call turns the hour-long elevation from login into a century:

$ curl -s -o /dev/null -w '%{http_code}\n' -X POST localhost:8791/client/1/elevate \
    -H "X-Gotify-Key: $TOK" -H 'Content-Type: application/json' -d '{"durationSeconds":3153600000}'
204
$ curl -s localhost:8791/current/user -H "X-Gotify-Key: $TOK"
{"id":1,...,"elevatedUntil":"2126-08-23T23:11:49.409030064-04:00"}

The caller must already be elevated, so this is not a privilege jump on its own — but it means a single moment of elevation (or a token stolen inside the hour after login) yields a session that never needs basic auth again, which is the opposite of what elevation is for. The UI has no way to show or revoke "elevated until 2126" other than deleting the client.

2. Large values silently overflow instead of erroring. time.Duration(DurationSeconds) * time.Second wraps for anything past ~292 years:

$ curl -s -o /dev/null -w '%{http_code}\n' -X POST localhost:8791/client/1/elevate \
    -H "X-Gotify-Key: $TOK" -H 'Content-Type: application/json' -d '{"durationSeconds":9223372036854775807}'
204
$ curl -s localhost:8791/current/user -H "X-Gotify-Key: $TOK"
{"id":1,...}        # elevatedUntil now in the past — 204, but elevation silently dropped

Suggestion: clamp durationSeconds with a binding:"min=1,max=…" tag (model.DefaultElevationDuration, or some multiple of it, seems like the natural ceiling) so both the century case and the overflow case become a 400.

Dominant language
Go
Stars
16k
Forks
891
Avg merge
2d 11h
Merged PRs (30d)
6

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from gotify/server

All issues in gotify/server

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.