Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

feat(security): scope dashboard OAuth session cookie to /dashboard path

Aperta
  • Qualcosa non va?
#330 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
java
Ambito
authentication, security

Direzione di ricerca

Start by reading AuthResource and trace how the session cookie is set and consumed by DashboardWebSocket and DashboardWebSocketConfigurator; check the auth integration tests and DashboardWebSocketTest. Verify Quarkus static resource and redirect behavior for the proposed cookie path, and decide how to scope the OAuth state cookie. Done means the login, redirect, dashboard, WebSocket, and logout flow passes with updated tests, the install flow is unaffected, and the security documentation is updated.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

enhancement java security
Problem Statement

Dashboard OAuth (#20 opaque sessions, #21 state validation) sets the thrillhouse_session cookie with path=/ in AuthResource (OAuth callback). That exposes the session identifier to every path on the origin — including static install assets (/install.html), health endpoints, and any future routes — even though only /dashboard/* and dashboard WebSocket/API paths consume it.

release_plan.md Step 4 notes this cookie-path scoping idea as backlog (low priority). It does not block releases but is a straightforward defense-in-depth hardening.

Proposed Solution
  1. Set thrillhouse_session cookie path to /dashboard (or /dashboard/ — verify Quarkus static resource and redirect behavior).
  2. Audit all consumers:
    • AuthResource — login callback, logout, /me
    • DashboardWebSocket / DashboardWebSocketConfigurator — cookie extraction
    • Any REST resources under /dashboard or /api/dashboard
  3. Ensure OAuth state cookie remains appropriately scoped (likely / or /api/auth — document choice).
  4. Update DashboardWebSocketTest and auth integration tests for the new path.
  5. Document in README security section / CHANGELOG when shipped.

Out of scope: changing session storage (#20), CSRF model (#21), or read-only API tokens (#326).

Related issues
  • #20 — opaque server-side sessions (closed)
  • #21 — OAuth state encoding (closed)
  • #326 — read-only dashboard API token (separate auth surface)
Acceptance criteria
  • thrillhouse_session cookie uses path=/dashboard (or documented equivalent that limits exposure)
  • Login → redirect → dashboard → WebSocket → logout flow works end-to-end
  • Existing session invalidation on logout unchanged
  • Tests updated; ./mvnw verify passes
  • No regression for install flow (/install.html) — cookie not sent to unrelated paths
Alternatives considered
  • __Host- prefix cookies — stricter but requires Secure + Path=/ + no Domain; may conflict with subpath dashboard hosting.
  • Separate subdomain for dashboard — larger deploy change; cookie path is sufficient for self-hosted single-origin.
Priority

Low — defense in depth; no known exploit. Schedule when touching dashboard auth or v1.0.0 hardening (#67 Helm may revisit ingress paths).

Code of Conduct
  • I have searched for existing issues and this is not a duplicate.
Lingua principale
Java
Stelle
35
Fork
7
Merge medio
7h 7m
PR unite (30g)
225

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di devops-thiago/ThrillhouseBot

Tutte le issue di devops-thiago/ThrillhouseBot

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.