fix(security): auth/session hardening from the pentest - #46
Merged
Conversation
Address the cookie-auth and login findings: - is_active on the web surface: `resolve_current_user` now rejects a deactivated account (it only re-fetched the user before), matching the API — deactivation revokes web access immediately instead of lingering until the JWT expires. - Constant-time login: `authenticate_local` runs an Argon2 verify (against a dummy hash) even when the email is unknown, removing the user-enumeration timing oracle. - CSRF defense-in-depth: the security middleware rejects state-changing (POST/PUT/ PATCH/DELETE) requests whose `Origin` doesn't match the host. Browser forms send a matching Origin; the agent/curl/Bearer API omit it (and carry no ambient cookie). - Cookie `Secure` everywhere except local dev (new `settings.cookie_secure`), so a non-production HTTPS deployment no longer ships cookies over plaintext. - `/docs`, `/redoc`, `/openapi.json` are disabled in production (info disclosure). Tests: cross-origin POST blocked / no-Origin allowed, the cookie_secure matrix, a deactivated user losing web access, and the login unknown/wrong/inactive paths. Full suite 226 passed; ruff + mypy(strict) green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pentest remediation (auth/session). Findings #2, #4, #6, #7, #8.
is_activeon the web cookie surface — deactivation now revokes web accessimmediately (the API already checked this).
enumeration timing oracle).
Origin(defense-in-depth atop SameSite=lax).
Secureoutside local dev (settings.cookie_secure)./docs/redoc/openapi.jsondisabled in production.Tests for each. Full suite 226 passed; ruff + mypy(strict) green.