kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(relay-auth): close 5 pre-production security findings (F1–F5)

Browse Source 
F1 (HIGH): bind step-up freshness to the required method (stepUpMethod) so a
  login-time or weaker (TOTP) factor can no longer satisfy a passkey requirement.
F2 (HIGH): make the step-up gate host-driven and fail-closed on connect+reattach
  (deny when policy.required and the principal is missing/stale/wrong-method).
F3 (MED): bind the WebAuthn assertion to the stored credential (credentialId
  cross-check + forward publicKey/credentialId to the verifier).
F4 (LOW): make verifyDpopProof totally fail-safe (no unhandled throw), wrap the
  authz boundary into a clean audited 401, and validate cnfJkt format at issue.
F5 (LOW): return newSignCount from finishAuthentication so the caller can persist
  the advanced counter (WebAuthn clone detection).

All fixes ship regression tests. relay-auth: 122 tests green, tsc clean.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:18 +02:00
parent 1529d2c94c
commit a09c131539
15 changed files with 248 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
relay-auth/test/enforce.test.ts
View File

@@ -20,7 +20,7 @@ const NOW = 1_700_000_000
const AUD_A = 'alice.term.example.com'
const ORIGIN_A = `https://${AUD_A}`
const ALLOWED = [ORIGIN_A]
const NEVER_REQUIRED: StepUpPolicy = { maxAgeSeconds: Number.MAX_SAFE_INTEGER, requiredMethod: 'passkey' }
const NEVER_REQUIRED: StepUpPolicy = { required: false, maxAgeSeconds: Number.MAX_SAFE_INTEGER, requiredMethod: 'passkey' }
describe('enforcement onUpgrade/onReattach (T12)', () => {
let signingKey: CryptoKey
@@ -126,8 +126,8 @@ describe('enforcement onUpgrade/onReattach (T12)', () => {
expect(out).toMatchObject({ ok: false, status: 403, reason: 'cross_tenant_session' })
})
describe('v0.10 step-up augmentation (Finding-3)', () => {
const STRICT: StepUpPolicy = { maxAgeSeconds: 300, requiredMethod: 'passkey' }
describe('v0.10 step-up augmentation (Finding-3, F1/F2)', () => {
const STRICT: StepUpPolicy = { required: true, maxAgeSeconds: 300, requiredMethod: 'passkey' }
it('fresh login but stale step-up → 403 step_up_required at onUpgrade', async () => {
deps = { ...deps, stepUpPolicyFor: () => STRICT }
@@ -141,10 +141,26 @@ describe('enforcement onUpgrade/onReattach (T12)', () => {
it('after a fresh step-up the same request → ok:true', async () => {
deps = { ...deps, stepUpPolicyFor: () => STRICT }
const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
const steppedUp = principal('acct-A', { authAt: NOW, stepUpAt: NOW, amr: ['passkey', 'stepup'] })
const steppedUp = principal('acct-A', { authAt: NOW, stepUpAt: NOW, amr: ['passkey', 'stepup'], stepUpMethod: 'passkey' })
expect(needsStepUp(steppedUp, STRICT, NOW)).toBe(false)
const out = await onUpgrade(ctxFor(b, { principal: steppedUp }), deps, ALLOWED, NOW)
expect(out.ok).toBe(true)
})
it('STRICT (required) policy + principal:null → 403 step_up_required (F2 fail-closed)', async () => {
deps = { ...deps, stepUpPolicyFor: () => STRICT }
const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
const out = await onUpgrade(ctxFor(b, { principal: null }), deps, ALLOWED, NOW)
expect(out).toMatchObject({ ok: false, status: 403, reason: 'step_up_required' })
expect(audit.events.some((e) => e.action === 'stepup' && e.outcome === 'deny')).toBe(true)
})
it('required:false policy + principal:null → allow (non-step-up host preserved)', async () => {
deps = { ...deps, stepUpPolicyFor: () => NEVER_REQUIRED }
const b = await issueWithDpop(signingKey, { accountId: 'acct-A', host: hostA, aud: AUD_A, now: NOW })
const out = await onUpgrade(ctxFor(b, { principal: null }), deps, ALLOWED, NOW)
expect(out.ok).toBe(true)
expect(audit.events.some((e) => e.outcome === 'allow')).toBe(true)
})
})
})