go-pkgz / auth
85%
master: 85%

LAST BUILD BRANCH: fix/auth-sensitive-logging
DEFAULT BRANCH: master
Repo Added
Files 25
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/csp-consumer-note
branch: fix/csp-consumer-note
CHANGE BRANCH
x

coverage: 85.425% (+0.03%) from 85.395%
26202851038

Pull #291

github

paskal 
docs(auth, avatar): fix misleading and stale docstrings around the security fix

Sweep over the docstrings touched (or adjacent to) PR #290's security work,
prompted by Copilot's post-merge review of withSecurityHeaders and an
adversarial pass from Codex on the rest of the same surface. All changes are
docstring/comment-only; no code, no behavior, no test churn.

  * withSecurityHeaders CONSUMER NOTE (auth.go, v2/auth.go) — the previous
    text told consumers HTML custom handlers could fix CSP blocking by
    "moving scripts/styles to external files served from 'self'", but the
    wrapper applies default-src 'none' and sandbox, so even self-hosted
    resources are blocked. New text spells out what the wrapper actually
    does and gives a concrete relaxed-CSP example. The example list also
    drops "dev_provider's login page" — that page is served by
    DevAuthServer on its own HTTP listener, not by handlers Service.Handlers
    wraps. Replaced with "custom server login pages".

  * Proxy.Put godoc — was "stores retrieved avatar to avatar.Store. Gets
    image from user info. Returns proxied url", which omitted the identicon
    fallback that fires on empty u.Picture, fetch failure, or non-image
    upstream bytes. Doc now describes that the function silently substitutes
    an identicon in those cases and returns its proxied URL — the caller
    is not told the upstream was rejected.

  * Proxy.Handler godoc — was "returns token routes for given provider",
    a leftover from a much older shape of the code. Replaced with a
    description of what Handler actually does today: serves stored avatar
    bytes by id, sniffs against an allowlist, sets defense headers.

  * Handler's inline serve-time validation comment — said "validate the
    bytes really are an image", but Handler reads up to sniffLen bytes
    and runs them through http.DetectContentType + an allowlist. That is
    content-type sniffing, not proof of full decodability. Reworded to
... (continued)
Pull Request #291: docs(auth, avatar): fix misleading and stale docstrings around the security fix

3042 of 3561 relevant lines covered (85.43%)

8.3 hits per line

Relevant lines Covered
3561 RELEVANT LINES 3042 COVERED LINES
8.3 HITS PER LINE
Source Files on fix/csp-consumer-note

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
26202851038 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.43
26202851040 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.39
26202167636 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.43
26202167622 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.39
26199873128 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.43
26199873127 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.39
26199874225 fix/csp-consumer-note docs(auth, avatar): fix misleading and stale docstrings around the security fix Sweep over the docstrings touched (or adjacent to) PR #290's security work, prompted by Copilot's post-merge review of withSecurityHeaders and an adversarial pass fro... Pull #291 paskal github
85.39
26199620340 fix/csp-consumer-note docs(auth): fix misleading withSecurityHeaders CONSUMER NOTE Per Copilot review on PR #290 (post-merge), the previous note suggested custom HTML handlers could fix CSP blocking by "moving scripts/styles to external files served from 'self'". That... Pull #291 paskal github
85.43
26199620312 fix/csp-consumer-note docs(auth): fix misleading withSecurityHeaders CONSUMER NOTE Per Copilot review on PR #290 (post-merge), the previous note suggested custom HTML handlers could fix CSP blocking by "moving scripts/styles to external files served from 'self'". That... Pull #291 paskal github
85.39
26199623976 fix/csp-consumer-note docs(auth): fix misleading withSecurityHeaders CONSUMER NOTE Per Copilot review on PR #290 (post-merge), the previous note suggested custom HTML handlers could fix CSP blocking by "moving scripts/styles to external files served from 'self'". That... Pull #291 paskal github
85.39
See All Builds (1088)