Web: serve the app from its own origin, not mostro.network/app/

Aperta
  • Qualcosa non va?
#699 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
dart, firebase, flutter
Ambito
devops, security, web-dev

Direzione di ricerca

Start with CLAUDE.md § Web and the deployment workflow in .github/workflows/web-build.yml; then review test/web/pages_bundle_test.dart and the smoke test's BASE_PATH. The issue also identifies the service-worker, Firebase, manifest, and documentation paths that need review. Done means serving from a confirmed dedicated origin, updating the listed path-dependent settings and references, and providing the old-origin recovery notice before redirecting users.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

The web app is published to https://mostro.network/app/ (deploy-pages.yml). Browser storage is scoped to the origin, not to the path, so everything the app keeps in localStorage and IndexedDB can be read by any script running on any page of https://mostro.network.

Today that origin also serves other GitHub Pages sites of the org. Checked on 2026-10-05:

Path Repo
/ MostroP2P.github.io
/protocol/ protocol (mdBook, with its own scripts)
/docs-english/, /docs-spanish/ docs-english, docs-spanish
/blog/ blog
/app/ app (this repo)

The org's other sites (mostro.foundation, mostro.watch, mostro.community, mostro.world) have custom domains and are not affected. Any repo in the org that turns on Pages without a custom domain joins this origin automatically. So a compromised dependency or build of any of those sites, or a malicious PR merged into one of them, can read the app's secrets from every user who opened the app in that browser.

What the app keeps on that origin

  • The mnemonic, through flutter_secure_storage (IdentityService). On web, flutter_secure_storage_web 1.2.1 stores the AES-GCM key exported raw in localStorage['FlutterSecureStorage'], next to the ciphertext. Any script on the origin can decrypt it with one WebCrypto call.
  • IndexedDB, written by the Rust core (rust/src/db/indexeddb.rs): identity, trade_keys, trades, messages (chat history), attachment_blobs, bond_claims and others.
  • After #650 and #651: the NWC URI, whose secret can spend from the user's wallet. In #651 it goes into the same storage as the mnemonic, with the same exposure.

Encrypting at rest inside the page cannot fix this. Whatever key the app uses has to be usable by same-origin script, so a non-extractable WebCrypto key in IndexedDB still decrypts for an attacker running on that origin. The boundary that holds is the origin itself.

Proposal

Serve the app from an origin of its own, for example https://app.mostro.network. With GitHub Pages that is a custom domain on this repo's Pages site (plus the DNS record); the other sites stay where they are.

Before choosing the domain, confirm that nothing else is or will be served on it.

What has to change with the path (/app/ → /)

Every one of these yields a blank or broken page when wrong (see CLAUDE.md § Web):

  • --base-href in .github/workflows/web-build.yml
  • test/web/pages_bundle_test.dart (it pins the sub-path)
  • The smoke test's BASE_PATH in CI
  • web/coi-serviceworker.min.js scope (cross-origin isolation)
  • The FCM worker (web/firebase-messaging-sw.js), registered relative to the base path, and its Firebase config (authorized domains for the new origin)
  • web/manifest.json: relative start_url and scope should follow by themselves; check installability (SMOKE_INSTALLABLE=1)
  • Links to mostro.network/app/ in docs, release notes (tool/release/downloads.dart), README and CLAUDE.md
Existing web users

The storage does not move with the app: on the new origin a returning user starts empty. Before redirecting, the old /app/ should:

  1. Show a notice explaining the move.
  2. Offer to show the recovery words, which are needed to restore on the new origin. Trade history can come back through restore; the NWC connection has to be pasted again.
  3. Only then redirect to the new origin.

Once the notice has been up long enough, /app/ can become a plain redirect.

Related

  • #650: NWC on web (this exposure is the reason it asks for #651 first).
  • #651: NWC URI in secure storage. It protects native, not web; see its review.
Lingua principale
Dart
Stelle
11
Fork
9
Merge medio
15h 41m
PR unite (30g)
158

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di MostroP2P/app

Tutte le issue di MostroP2P/app

Issue simili

Altre issue su Dart

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.