FIWARE / VCVerifier / 36137313263

70%

main: 73%

Pull #127

github

fix(openapi): restrict WebSocket upgrades to the verifier's own origin

CheckOrigin accepted any origin, and the login-notification WebSocket carries
no other authentication - anyone who obtained a session's state value (not a
secret in a QR flow; it's meant to be scanned) could open a connection to it
directly and receive the resulting authorization code intended for the
original browser.

Restrict the handshake to the verifier's own configured host, independent of
the general CORS AllowedOrigins policy (main.go), which intentionally
defaults to "*" for API compatibility - that default is fine for read-only
API responses but not for a channel that hands over a login's authorization
code.

Session ownership (distinguishing a legitimate reconnect of the same browser
from a second, unrelated party) is a separate follow-up; this change only
closes the cross-origin attack surface.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

23 of 27 new or added lines in 1 file covered. (85.19%)

7715 of 11025 relevant lines covered (69.98%)

0.81 hits per line