psa-systems/lets-chat
Watch
9
0
Fork
You've already forked lets-chat
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(auth): drop lets-chat session on Bunyip identity swap (LC-414) #429

Merged
YousifShkara merged 1 commit from fix/LC-414-session-bunyip-sub-reconcile into main 2026-06-21 09:42:56 +02:00
Conversation 0 Commits 1 Files changed 2 +92
YousifShkara commented 2026-06-21 09:12:46 +02:00
Owner
Copy link

inject_user now reads the Bunyip access_token cookie (shared eTLD+1 cookie domain) on every authed request. If its sub claim disagrees with the bunyip_sub stamped on the user the lets-chat session resolves to, the browser has signed into Bunyip as a different user since the lets-chat session was minted. The middleware deletes the stale lets-chat session and skips user injection, so the next handler resolves an anonymous request and the existing redirect chain bounces through /auth/bunyip/start to re-auth. The check is best-effort: no Bunyip cookie present (dev, or a never-cookied browser), a malformed cookie, or a row that predates LC-22 (no bunyip_sub) all no-op so a real user is never logged out spuriously. The sub is decoded base64-only without JWKS verification: this is an identity-drift detector, not an auth boundary (auth comes from the lets-chat session), and the worst attacker outcome from a forged Bunyip cookie is a forced logout of the legitimate user, not access.

#LC-414

`inject_user` now reads the Bunyip `access_token` cookie (shared eTLD+1 cookie domain) on every authed request. If its `sub` claim disagrees with the `bunyip_sub` stamped on the user the lets-chat session resolves to, the browser has signed into Bunyip as a different user since the lets-chat session was minted. The middleware deletes the stale lets-chat session and skips user injection, so the next handler resolves an anonymous request and the existing redirect chain bounces through `/auth/bunyip/start` to re-auth. The check is best-effort: no Bunyip cookie present (dev, or a never-cookied browser), a malformed cookie, or a row that predates LC-22 (no `bunyip_sub`) all no-op so a real user is never logged out spuriously. The `sub` is decoded base64-only without JWKS verification: this is an identity-drift detector, not an auth boundary (auth comes from the lets-chat session), and the worst attacker outcome from a forged Bunyip cookie is a forced logout of the legitimate user, not access. #LC-414
fix(auth): drop lets-chat session on Bunyip identity swap (LC-414)
All checks were successful
check-secrets / Kingfisher (push) Successful in 4s
Details
check-secrets / TruffleHog (push) Successful in 4s
Details
check-secrets / Nosey parker (push) Successful in 4s
Details
check-secrets / Kingfisher (pull_request) Successful in 4s
Details
check-secrets / TruffleHog (pull_request) Successful in 4s
Details
check-secrets / Nosey parker (pull_request) Successful in 5s
Details
Check / clippy + fmt + tests (pull_request) Successful in 5m23s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
4ca62929f4 
`inject_user` now reads the Bunyip `access_token` cookie (shared eTLD+1 cookie domain) on every authed request. If its `sub` claim disagrees with the `bunyip_sub` stamped on the user the lets-chat session resolves to, the browser has signed into Bunyip as a different user since the lets-chat session was minted. The middleware deletes the stale lets-chat session and skips user injection, so the next handler resolves an anonymous request and the existing redirect chain bounces through `/auth/bunyip/start` to re-auth. The check is best-effort: no Bunyip cookie present (dev, or a never-cookied browser), a malformed cookie, or a row that predates LC-22 (no `bunyip_sub`) all no-op so a real user is never logged out spuriously. The `sub` is decoded base64-only without JWKS verification: this is an identity-drift detector, not an auth boundary (auth comes from the lets-chat session), and the worst attacker outcome from a forged Bunyip cookie is a forced logout of the legitimate user, not access.

#LC-414
YousifShkara deleted branch fix/LC-414-session-bunyip-sub-reconcile 2026-06-21 09:42:56 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/lets-chat!429
No description provided.