mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-27 14:57:15 +00:00
xarmian
67d06fdf81
(a) Sessions did not record how they were issued, and SessionAuth accepted
any padsess_ token from a cookie as a cookie session. isBearerAuth is
decided by transport, so an admin's CLI session sent as a Cookie picked up
the cookie-only platform-admin bypass that bearer use is denied (BUG-1616).
- Migration 105/079 adds sessions.kind ('web' | 'cli'). It backfills 'cli'
from device_info 'cli-browser-auth' (lead's ruling: no forced re-login;
older CLI password logins stay 'web' until they expire).
- The kind comes from the device label at creation.
- The CLI sends X-Pad-Client: cli, so its password and 2FA sign-ins mint a
'cli' session and set no cookie. Rotation keeps the replaced session's
kind.
- SessionAuth, validateSessionCookie and requestSessionInfo's cookie path
accept only a 'web' session as a cookie. A CLI session still works as
the bearer it is.
(b) /auth/login (and 2FA login-verify) were CSRF-exempt and decoded JSON
whatever the Content-Type, so a cross-site text/plain form could sign the
victim into the attacker's account. A sign-in must now be
application/json (415 otherwise), and an Origin the browser names must be
this server (its Host or base URL) or an allowed CORS origin, including the
localhost defaults the dev server uses (403 otherwise). Headless clients
send no Origin. An E2E leg pins the web app's own login form sending JSON.
Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC
13 lines
793 B
SQL
13 lines
793 B
SQL
-- Migration 105: record how a session was issued (BUG-3350). A session minted
|
|
-- for the CLI (browser approval, or `pad auth login -i`) is a bearer
|
|
-- credential and must never be accepted as a browser cookie: sent as one, it
|
|
-- picked up the cookie-only platform-admin bypass that bearer use is denied
|
|
-- (BUG-1616). SessionAuth now accepts a cookie only for kind = 'web'.
|
|
--
|
|
-- Backfill from device_info: only the browser-approval flow ever recorded
|
|
-- 'cli-browser-auth'. Password logins from the CLI were recorded as 'web'
|
|
-- and stay so until they expire (lead's ruling: no forced re-login; the CLI
|
|
-- now marks its logins, so new ones are 'cli').
|
|
ALTER TABLE sessions ADD COLUMN kind TEXT NOT NULL DEFAULT 'web';
|
|
UPDATE sessions SET kind = 'cli' WHERE device_info = 'cli-browser-auth';
|