umputun / secrets / 33955453719

84%

push

github

fix: close log, session and rate-limit gaps found in the security review (#134)

* fix: close log, session and rate-limit gaps found in the security review

- mask key and pin in every request log line by path position, not key length;
  12-char keys were logged with the pin in clear
- stop dumping the decoded request body and pin on API JSON decode errors
- bind session signature to uuid.timestamp, reject malformed ids and future
  timestamps, and derive the session secret from SignKey and AuthHash
- trust proxy client-IP headers only behind --proxy-trust-headers; compose
  examples enable it and strip client-supplied headers at the proxy
- keep the decryption key out of the email popup GET, attach it on submit
  only, and document that emailing the link hands the key to the server

* fix: hash the client ip without the ephemeral port

without rest.RealIP in the chain RemoteAddr carries the port, so the hashed
ip in the logs changed on every connection instead of identifying a client

36 of 37 new or added lines in 4 files covered. (97.3%)

1740 of 2069 relevant lines covered (84.1%)

80.32 hits per line