fix(security): harden auth, session, csrf, csp (sec-auth-01..09)#43
Open
Abdulkhalek-1 wants to merge 2 commits intomainfrom
Open
fix(security): harden auth, session, csrf, csp (sec-auth-01..09)#43Abdulkhalek-1 wants to merge 2 commits intomainfrom
Abdulkhalek-1 wants to merge 2 commits intomainfrom
Conversation
Implements 9 security hardening plans covering OAuth, sessions, CSRF, and CSP: - sec-auth-01: hard-fail in production when DASHBOARD_SESSION_SECRET is missing or too short - sec-auth-02: use trusted DASHBOARD_PUBLIC_URL for OAuth callback instead of attacker-controllable x-forwarded-host - sec-auth-03: clear oauth_state cookie immediately after validation to prevent replay on failure - sec-auth-04: regenerate sessions on login (drop existing rows for the user) to prevent fixation - sec-auth-05: re-fetch fresh guild membership every 5 minutes in requireGuildAdmin to close stale-cache access window - sec-auth-06: add CSRF double-submit token enforcement on mutating /api routes, issued via GET /auth/csrf - sec-auth-07: replace style-src 'unsafe-inline' with per-request CSP nonces (helmet enableCSPNonces) - sec-auth-08: tighten oauth_state cookie to SameSite=Strict - sec-auth-09: reduce session TTL from 7 days to 24 hours Adds DASHBOARD_PUBLIC_URL config field and new csrf.ts shared module. Typecheck clean. Dashboard test suite: 14 fail / 298 pass -- net improvement over baseline (15 failures); no new regressions. Note: SPA client will need a follow-up change to fetch /auth/csrf and include X-CSRF-Token on mutating requests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements 9 security hardening plans covering OAuth, sessions, CSRF, and CSP.
Changes
Follow-up required
The SPA client needs to fetch `/auth/csrf` and include `X-CSRF-Token` on POST/PUT/PATCH/DELETE. Not in this PR. Merging before the SPA update will break mutating API calls.
Test plan
🤖 Generated with Claude Code