kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(relay-auth): close 5 pre-production security findings (F1–F5)

Browse Source 
F1 (HIGH): bind step-up freshness to the required method (stepUpMethod) so a
  login-time or weaker (TOTP) factor can no longer satisfy a passkey requirement.
F2 (HIGH): make the step-up gate host-driven and fail-closed on connect+reattach
  (deny when policy.required and the principal is missing/stale/wrong-method).
F3 (MED): bind the WebAuthn assertion to the stored credential (credentialId
  cross-check + forward publicKey/credentialId to the verifier).
F4 (LOW): make verifyDpopProof totally fail-safe (no unhandled throw), wrap the
  authz boundary into a clean audited 401, and validate cnfJkt format at issue.
F5 (LOW): return newSignCount from finishAuthentication so the caller can persist
  the advanced counter (WebAuthn clone detection).

All fixes ship regression tests. relay-auth: 122 tests green, tsc clean.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:18 +02:00
parent 1529d2c94c
commit a09c131539
15 changed files with 248 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
relay-auth/src/capability/errors.ts
View File

@@ -11,6 +11,7 @@ export type CapabilityErrorReason =
| 'bad_signature'
| 'replayed'
| 'no_cnf'
| 'bad_cnf'
export class CapabilityError extends Error {
readonly reason: CapabilityErrorReason

2
relay-auth/src/capability/issue.ts
View File

@@ -49,6 +49,8 @@ export async function issueCapabilityToken(
for (const r of a.rights) CapabilityRightSchema.parse(r)
if (a.rights.length === 0) throw new CapabilityError('malformed', 'rights must be non-empty')
if (a.cnfJkt.length === 0) throw new CapabilityError('no_cnf')
// A base64url SHA-256 JWK thumbprint is exactly 43 chars of [A-Za-z0-9_-] (hardening, Finding-4).
if (!/^[A-Za-z0-9_-]{43}$/.test(a.cnfJkt)) throw new CapabilityError('bad_cnf')
const ttl = Math.max(a.ttlSeconds, CONNECT_TOKEN_MIN_TTL_SEC)
const body: TokenBody = {

63
relay-auth/src/capability/verify.ts
View File

@@ -116,38 +116,45 @@ export async function verifyDpopProof(
dpop: DpopContext,
now: number,
): Promise<boolean> {
const expectedJkt = readCnfJkt(token)
const parts = dpop.proofJws.split('.')
if (parts.length !== 3) return false
const [h, p, s] = parts as [string, string, string]
let header: DpopHeader
let payload: DpopPayload
// TOTALLY fail-safe (Finding-4): any thrown error — from readCnfJkt, jwkThumbprint,
// importEd25519PublicRaw, or any decode — becomes `false`, never a rejected promise, so the
// INV15 gate always denies through an audited path instead of an unhandled exception.
try {
header = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(h))) as DpopHeader
payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(p))) as DpopPayload
const expectedJkt = readCnfJkt(token)
const parts = dpop.proofJws.split('.')
if (parts.length !== 3) return false
const [h, p, s] = parts as [string, string, string]
let header: DpopHeader
let payload: DpopPayload
try {
header = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(h))) as DpopHeader
payload = JSON.parse(new TextDecoder().decode(decodeBase64UrlBytes(p))) as DpopPayload
} catch {
return false
}
if (header.jwk?.kty !== 'OKP' || header.jwk?.crv !== 'Ed25519') return false
let rawPub: Uint8Array
try {
rawPub = decodeBase64UrlBytes(header.jwk.x)
} catch {
return false
}
if ((await jwkThumbprint(rawPub)) !== expectedJkt) return false
if (payload.htu !== dpop.htu || payload.htm !== dpop.htm) return false
if (typeof payload.iat !== 'number' || Math.abs(now - payload.iat) > DPOP_MAX_AGE_SEC) return false
const signed = new TextEncoder().encode(`${h}.${p}`)
const pubKey = await importEd25519PublicRaw(rawPub)
let sig: Uint8Array
try {
sig = decodeBase64UrlBytes(s)
} catch {
return false
}
if (!(await verifyEd25519(pubKey, sig, signed))) return false
return rememberDpop(payload.jti, payload.iat + DPOP_MAX_AGE_SEC, now)
} catch {
return false
}
if (header.jwk?.kty !== 'OKP' || header.jwk?.crv !== 'Ed25519') return false
let rawPub: Uint8Array
try {
rawPub = decodeBase64UrlBytes(header.jwk.x)
} catch {
return false
}
if ((await jwkThumbprint(rawPub)) !== expectedJkt) return false
if (payload.htu !== dpop.htu || payload.htm !== dpop.htm) return false
if (typeof payload.iat !== 'number' || Math.abs(now - payload.iat) > DPOP_MAX_AGE_SEC) return false
const signed = new TextEncoder().encode(`${h}.${p}`)
const pubKey = await importEd25519PublicRaw(rawPub)
let sig: Uint8Array
try {
sig = decodeBase64UrlBytes(s)
} catch {
return false
}
if (!(await verifyEd25519(pubKey, sig, signed))) return false
return rememberDpop(payload.jti, payload.iat + DPOP_MAX_AGE_SEC, now)
}
/** Build a DPoP proof (client-side helper; also used by tests). Signs with the ephemeral key. */