Epic: v0.21 security review follow-ups

Aberta
  • Algo errado?
#558 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
5/5
Tempo estimado
Mais de uma semana
Facilidade para iniciantes
8/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
express, go, nextjs, python, rust, typescript
Domínio
authentication, backend, security

Direção de pesquisa

This is a tracking epic, not a task: each checkbox links to a separate issue in one of the seamless-auth repositories. Pick one linked child issue that has no assignee or pull request, read its own description, and work from there. Done means that child issue's fix is merged and its box can be ticked.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

epic P1 security v0.23

Follow-ups from the security review of the v0.21 release train: API v0.21.1, OIDC provider edge v0.1.1, @seamless-auth/core and express 0.23.0, fastify 0.14.0, nextjs 0.7.0, and the Go, Python and Rust adapters at v0.4.0.

The review traced sign-in, token issuance and verification, the /oidc/* service surface, inbound OAuth, application notices, step-up, and each adapter's cookie, refresh, origin and proxy paths. No unauthenticated account takeover was found. Findings that need private handling are tracked separately.

Three findings repeat across adapters and should land together: the origin check on unsafe methods, the 5 second refresh replay window, and the JWKS lock held across the network fetch.

API
  • fells-code/seamless-auth-api#552 Derive hardware-bound passkey assurance from the registered credential
  • fells-code/seamless-auth-api#553 Key the application notice per-user limit on the canonical user id
  • fells-code/seamless-auth-api#554 Keep application notice text from carrying its own links and attribution
  • fells-code/seamless-auth-api#555 Enforce third_party_clients_enabled when serving and signing for existing clients
  • fells-code/seamless-auth-api#556 Harden secret responses, external delivery tokens and provider fetches outside production
  • fells-code/seamless-auth-api#557 Send owner notice kinds the adapter does not deliver
seamless-auth-server
  • fells-code/seamless-auth-server#256 Require a JSON content type on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-server#257 Detect any trust-everything proxy setting in Express before forwarding the client IP
  • fells-code/seamless-auth-server#258 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-server#259 Keep the auth server path prefix in the JWKS URL
  • fells-code/seamless-auth-server#260 Mark client credentials tokens on the resource server user and verify the ephemeral token at registration
OIDC provider edge
  • fells-code/seamless-auth-oidc-provider#39 Ask for explicit confirmation before auto-consenting a first-party native client
  • fells-code/seamless-auth-oidc-provider#40 Accept a hop count or subnet list for TRUST_PROXY
  • fells-code/seamless-auth-oidc-provider#41 Clear first-party cookies at /session/end only when the provider session had an account
  • fells-code/seamless-auth-oidc-provider#42 Match provider routes the way oidc-provider does
  • fells-code/seamless-auth-oidc-provider#43 Reload signing keys when the API rotates
  • fells-code/seamless-auth-oidc-provider#44 Remove the grant when the auth context check fails and add a JSON error handler
Go adapter
  • fells-code/seamless-auth-go#21 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-go#22 Run refresh rotation detached from the request and keep cookies on transport errors
  • fells-code/seamless-auth-go#23 Check Origin on unsafe methods whatever the SameSite setting
Python adapter
  • fells-code/seamless-auth-python#23 Raise the PyJWT floor to 2.10.1
  • fells-code/seamless-auth-python#24 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-python#25 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-python#26 Harden redirects, logout revocation and JWK use checks
Rust adapter
  • fells-code/seamless-auth-rust#24 Check Origin on unsafe methods whatever the SameSite setting
  • fells-code/seamless-auth-rust#25 Do not hold the JWKS cache lock across the network fetch
  • fells-code/seamless-auth-rust#26 Stop replaying a completed refresh rotation to later callers
  • fells-code/seamless-auth-rust#27 Keep rotated cookies on upstream errors and clear the custom pre-auth cookie on logout
Linguagem predominante
TypeScript
Estrelas
2
Forks
2
Merge médio
11h 40min
PRs com merge (30d)
104

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de fells-code/seamless-auth-api

Todas as issues de fells-code/seamless-auth-api

Issues semelhantes

Mais issues de TypeScript

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.