hyperscale-stack / security / 39661770652

98%

Build Type

push

github

Committed by web-flow

Commit Message

fix(core)!: close the core findings of the 2026-10-21 security audit

Close the core, adapter, basic, bearer, password, outbound and session
findings of the security audit of 2026-10-21.

- basic: opt-in attempt limiting through the core AttemptLimiter
  (WithAttemptLimiter, WithAttemptSubject), asked before the lookup and
  settled after the verification; a typed-nil user is an unknown user
  (D-20, F-16).
- grpcsec: the panics of the security pipeline are recovered and answered
  with Internal, never exposing the value; WithPanicHandler receives it
  (I-26).
- Typed-nil dependencies are refused at construction across the core,
  voter, adapters, basic, bearer and session (I-27); session refuses
  typed-nil principals and sessions without a subject (F-15).
- bearer/httpsec: RFC 6750 §2.1 b64token syntax enforced, tokens capped
  at 16 KiB, tab-ended Bearer fields handled (F-17).
- outbound: canonical ports, ISATAP identifiers refused, dial errors no
  longer name the resolved address (F-14, I-29, D-16).
- password: only canonical PHC / bcrypt encodings verify (I-30).
- session: CSRF tokens masked per rendering, constant-time comparison
  pinned; the cookie-tossing documentation is corrected (I-31, F-24,
  I-28).
- AnonymousPrincipal and the default clock are immutable (I-32).
- D-21, D-22, D-23 documented as deliberate limits.

Breaking changes and migration steps: MIGRATION.md.

Audit: F-14, F-15, F-16, F-17, F-24, I-26, I-27, I-28, I-29, I-30, I-31, I-32, D-16, D-20, D-21, D-22, D-23.

Coverage Stats

288 of 288 new or added lines in 35 files covered. (100.0%)

1 existing line in 1 file now uncovered.

14756 of 14970 relevant lines covered (98.57%)

5156.87 hits per line