Epic: v0.21 security review follow-ups

オープン
  • 何か問題がありますか？
#558 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
8/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
express, go, nextjs, python, rust, typescript
領域
authentication, backend, security

調査の方向性

This is a tracking epic, not a task: each checkbox links to a separate issue in one of the seamless-auth repositories. Pick one linked child issue that has no assignee or pull request, read its own description, and work from there. Done means that child issue's fix is merged and its box can be ticked.

索引モデルが issue の本文から書いたものです。

説明

epic P1 security v0.23

Follow-ups from the security review of the v0.21 release train: API v0.21.1, OIDC provider edge v0.1.1, @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0, and the Go, Python and Rust adapters at v0.4.0.

The review traced sign-in, token issuance and verification, the /oidc/* service surface, inbound OAuth, application notices, step-up, and each adapter's cookie, refresh, origin and proxy paths. No unauthenticated account takeover was found. Findings that need private handling are tracked separately.

Three findings repeat across adapters and should land together: the origin check on unsafe methods, the 5 second refresh replay window, and the JWKS lock held across the network fetch.

API
  • fells-code/seamless-auth-api#552 Derive hardware-bound passkey assurance from the registered credential
  • fells-code/seamless-auth-api#553 Key the application notice per-user limit on the canonical user id
  • fells-code/seamless-auth-api#554 Keep application notice text from carrying its own links and attribution
  • fells-code/seamless-auth-api#555 Enforce third_party_clients_enabled when serving and signing for existing clients
  • fells-code/seamless-auth-api#556 Harden secret responses, external delivery tokens and provider fetches outside production
  • fells-code/seamless-auth-api#557 Send owner notice kinds the adapter does not deliver
seamless-auth-server
  • fells-code/seamless-auth-server#256 Require a JSON content type on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-server#257 Detect any trust-everything proxy setting in Express before forwarding the client IP
  • fells-code/seamless-auth-server#258 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-server#259 Keep the auth server path prefix in the JWKS URL
  • fells-code/seamless-auth-server#260 Mark client credentials tokens on the resource server user and verify the ephemeral token at registration
OIDC provider edge
  • fells-code/seamless-auth-oidc-provider#39 Ask for explicit confirmation before auto-consenting a first-party native client
  • fells-code/seamless-auth-oidc-provider#40 Accept a hop count or subnet list for TRUST_PROXY
  • fells-code/seamless-auth-oidc-provider#41 Clear first-party cookies at /session/end only when the provider session had an account
  • fells-code/seamless-auth-oidc-provider#42 Match provider routes the way oidc-provider does
  • fells-code/seamless-auth-oidc-provider#43 Reload signing keys when the API rotates
  • fells-code/seamless-auth-oidc-provider#44 Remove the grant when the auth context check fails and add a JSON error handler
Go adapter
  • fells-code/seamless-auth-go#21 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-go#22 Run refresh rotation detached from the request and keep cookies on transport errors
  • fells-code/seamless-auth-go#23 Check Origin on unsafe methods whatever the SameSite setting
Python adapter
  • fells-code/seamless-auth-python#23 Raise the PyJWT floor to 2.10.1
  • fells-code/seamless-auth-python#24 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-python#25 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-python#26 Harden redirects, logout revocation and JWK use checks
Rust adapter
  • fells-code/seamless-auth-rust#24 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-rust#25 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-rust#26 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-rust#27 Keep rotated cookies on upstream errors and clear the custom pre-auth cookie on logout
主要言語
TypeScript
スター
2
フォーク
2
平均マージ
11時間 40分
マージ済み PR（30日）
104

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

fells-code/seamless-auth-api のほかの issue

fells-code/seamless-auth-api の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。