Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Security hardening for bit Boilerplate's sign-in codes, sessions, chatbot, push, uploads, token storage and CD

オープン
  • 何か問題がありますか？
#14,109 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@yasmoradi がすでに取り組んでいます。

2026年10月22日 から。

  • #14114 @yasmoradi による — オープン

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
15/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
停滞
技術スタック
csharp
領域
security

調査の方向性

The issue lists findings across server, clients, and pipelines, and links open pull request #14114. Start by reviewing that pull request and its changed files to see which findings are already being addressed. The issue does not name tests or specific files; done would require resolving the listed security findings across the affected areas.

索引モデルが issue の本文から書いたものです。

説明

A security review of bit Boilerplate found the problems below.

Server

  1. The security stamp is inside every access, refresh and OAuth token, and the 6-digit codes (OTP, magic link, reset password, step-up, phone/email 2FA) are TOTP codes keyed on that stamp. Anyone who can read a token can compute the user's codes.
  2. The phone/email 2FA code uses the fixed TwoFactor purpose, so one code stays valid for its whole TOTP window and works more than once.
  3. The AI chat has no limit on message length, answer length or how often one user or IP can chat, so a single caller can run up the AI bill.
  4. A web push subscription's Endpoint can be any URL, and the server POSTs to it through an HttpClient that follows redirects and resolves service discovery names (SSRF). The push endpoints have no rate limit either.
  5. A SignalR connection keeps working for its session after the session is revoked or the security stamp changes.
  6. Resetting the password of an account with 2FA on only needs the code sent to email or SMS, so whoever controls the inbox or the SIM takes the account over.
  7. Uploaded images go to whatever ImageMagick coder matches them (SVG, PS, PDF, ...), and the *Original kinds are served back in the uploaded format.
  8. The send-token endpoints answer UserNotFound for unknown identifiers and sign-up answers DuplicateEmailOrPhoneNumber, so anyone can check which emails and phone numbers have accounts.

Clients

  1. Tokens are stored in plain text: MAUI keeps them in Preferences (which Android backs up) and Windows in a plain JSON file.
  2. Other browser tabs don't notice a sign-in, a sign-out or a user change. A tab can keep showing user A while its API calls carry user B's token.
  3. Signing in while already signed in (for example by opening a magic link) leaves the old session behind. It stays in the sessions list and can hold a privileged session slot for 14 days.
  4. A token refresh that completes after a sign-out writes the tokens back, so the user is signed in again.
  5. When a connection goes straight from user A to user B, AppHub leaves the connection id on A's session too, so A's OTP, PROFILE_UPDATED and SESSION_REVOKED messages reach B.
  6. SESSION_REVOKED carries no session id, so the client signs out whoever is current, and PROFILE_UPDATED is applied without checking the user id.

Pipelines

  1. cd-production.yml deploys every push to main without running the tests, and nothing applies EF migrations outside Development.
  2. The pipelines, the dev container and the docs install Bit.Cli with --prerelease.
主要言語
C#
スター
1.4k
フォーク
264
平均マージ
13時間 15分
マージ済み PR（30日）
344

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

bitfoundation/bitplatform のほかの issue

bitfoundation/bitplatform の issue をすべて見る

似ている issue

C# の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。