hyperscale-stack / security / 38361599030

98%

push

github

fix(session,password,basic)!: close the security audit findings of the session, password and HTTP Basic modules

Harden the session, password and HTTP Basic modules (internal security
audit of 2026-10-12).

- basic: every attempt runs exactly one hasher.Verify (a dummy hash from
  the configured hasher for unknown users, loader failures and accounts
  without a hash), at most GOMAXPROCS verifications at once (503 when the
  caller gives up); strict RFC 7617 parsing: canonical base64, UTF-8, no
  control, format (Unicode Cf) or line/paragraph separator character in
  the user-id or the password, an empty user-id refused.
- password: stored hash parameters are checked before any hashing (RFC
  9106 §3.1 ranges, operator limits); bcrypt refuses passwords over 72
  bytes and every hasher refuses empty passwords.
- session: format 2 cookies — keys of at least 32 bytes through HKDF,
  AES-256-GCM bound to the format, the cookie name and its purpose; the
  absolute lifetime CreatedAt + TTL is enforced on every read and never
  extended; numbers decode exactly (json.Number, GetInt64); __Host-session
  by default, invalid cookie configurations refused at construction; two
  valid session cookies of one name leave the request without a session;
  optional WithValidator for server-side revocation (503 on outage).
- basic, bearer and session authentications and session.Session never
  print, log or encode their secrets; failed authenticators return
  security.Anonymous().
- Examples: no demo token endpoint, 15-minute RFC 9068 demo tokens in a
  0600 file, a CSRF-protected sign-in whose form session lives on its own
  Manager.

Breaking: every existing session cookie is refused once; see MIGRATION.md.

Audit: CORE-03, CORE-04, CORE-06, CORE-08, CORE-09, CORE-11, CORE-12, CORE-14, CORE-15, CORE-I7, CORE-I8, CORE-I9.

525 of 527 new or added lines in 14 files covered. (99.62%)

13738 of 13953 relevant lines covered (98.46%)

4947.38 hits per line