psa-systems/mokosh-apps
Watch
9
0
Fork
You've already forked mokosh-apps
 0
Code Issues Pull requests 1 Projects Releases 14 Packages Wiki Activity Actions

fix(spa): SPA hardening cluster (state/nonce, dev-bypass feature, pending TTL, CSP, doc) #384

Merged
YousifShkara merged 1 commit from fix/MAPPS-338-spa-hardening-cluster into main 2026-06-30 06:01:13 +02:00
Conversation 0 Commits 1 Files changed 6 +72 -8
YousifShkara commented 2026-06-30 05:45:57 +02:00
Owner
Copy link

MAPPS-338: four surgical hardening items from the 2026-06-30 audit. Item 1 of the original five (id_token signature verify in WASM via JWKS) is deferred to a separate ticket because it requires more infrastructure (WASM-compatible jsonwebtoken + JWKS fetch + kid cache); the four landing here are all bounded edits.

  1. state + nonce 32 bytes. src/modules/oidc/pkce.rs::random_opaque now generates 32 bytes (256 bits) instead of 16. RFC 6819 §5.3.5 floors state at 128 bits; matching the PKCE verifier entropy budget removes nonce as the weakest link in the flow.
  2. dev-admin bypass behind a feature flag. src/hooks/auth.rs::initial_auth_context was gated on cfg(debug_assertions) alone, so a debug WASM that shipped to staging by accident (CI mishap, operator build) auto-signed the user in as Admin from compile-time ADMIN_EMAIL/ADMIN_PASSWORD. New dev_admin_bypass feature is OFF by default even in debug builds; dev devs opt in via cargo run --features dev_admin_bypass.
  3. PendingFlow TTL. src/modules/oidc/storage.rs::PendingFlow now carries issued_at_ms, stamped on save_pending and checked on take_pending. Flows older than PENDING_FLOW_TTL_MS (10 min) are refused, so a week-old tab does not satisfy the OIDC callback. The mint side in src/modules/oidc/flow.rs is updated to pass &mut PendingFlow; #[serde(default)] on the new field keeps existing in-flight session storage rows deserializable (their issued_at_ms = 0 reads as expired, which forces a clean re-auth).
  4. Runtime CSP from env. oci-build/Caddyfile previously emitted only Content-Security-Policy: frame-ancestors 'none' because connect-src depends on MOKOSH_API_BASE / MOKOSH_OIDC_ISSUER (set by the entrypoint at container start and unknown at build time). Caddy's {$VAR:-default} expands at startup, so the same image now ships a full CSP (default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' {$MOKOSH_API_BASE:-} {$MOKOSH_OIDC_ISSUER:-}; ...) that pins the SPA's exfil surface. When the env vars are empty the directive collapses to 'self' for those sources, which is correct for the same-origin (host-prefix-derived) case.

#MAPPS-338

MAPPS-338: four surgical hardening items from the 2026-06-30 audit. Item 1 of the original five (id_token signature verify in WASM via JWKS) is deferred to a separate ticket because it requires more infrastructure (WASM-compatible jsonwebtoken + JWKS fetch + kid cache); the four landing here are all bounded edits. 1. **state + nonce 32 bytes.** `src/modules/oidc/pkce.rs::random_opaque` now generates 32 bytes (256 bits) instead of 16. RFC 6819 §5.3.5 floors `state` at 128 bits; matching the PKCE verifier entropy budget removes nonce as the weakest link in the flow. 2. **dev-admin bypass behind a feature flag.** `src/hooks/auth.rs::initial_auth_context` was gated on `cfg(debug_assertions)` alone, so a debug WASM that shipped to staging by accident (CI mishap, operator build) auto-signed the user in as Admin from compile-time `ADMIN_EMAIL`/`ADMIN_PASSWORD`. New `dev_admin_bypass` feature is OFF by default even in debug builds; dev devs opt in via `cargo run --features dev_admin_bypass`. 3. **PendingFlow TTL.** `src/modules/oidc/storage.rs::PendingFlow` now carries `issued_at_ms`, stamped on `save_pending` and checked on `take_pending`. Flows older than `PENDING_FLOW_TTL_MS` (10 min) are refused, so a week-old tab does not satisfy the OIDC callback. The mint side in `src/modules/oidc/flow.rs` is updated to pass `&mut PendingFlow`; `#[serde(default)]` on the new field keeps existing in-flight session storage rows deserializable (their `issued_at_ms = 0` reads as expired, which forces a clean re-auth). 4. **Runtime CSP from env.** `oci-build/Caddyfile` previously emitted only `Content-Security-Policy: frame-ancestors 'none'` because `connect-src` depends on `MOKOSH_API_BASE` / `MOKOSH_OIDC_ISSUER` (set by the entrypoint at container start and unknown at build time). Caddy's `{$VAR:-default}` expands at startup, so the same image now ships a full CSP (`default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' {$MOKOSH_API_BASE:-} {$MOKOSH_OIDC_ISSUER:-}; ...`) that pins the SPA's exfil surface. When the env vars are empty the directive collapses to `'self'` for those sources, which is correct for the same-origin (host-prefix-derived) case. #MAPPS-338
fix(spa): SPA hardening cluster (state/nonce, dev-bypass feature, pending TTL, CSP, doc)
All checks were successful
Check / fmt + clippy + tests (pull_request) Successful in 1m57s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
80726afdae 
MAPPS-338: four surgical hardening items from the 2026-06-30 audit. Item 1 of the original five (id_token signature verify in WASM via JWKS) is deferred to a separate ticket because it requires more infrastructure (WASM-compatible jsonwebtoken + JWKS fetch + kid cache); the four landing here are all bounded edits.

1. **state + nonce 32 bytes.** `src/modules/oidc/pkce.rs::random_opaque` now generates 32 bytes (256 bits) instead of 16. RFC 6819 §5.3.5 floors `state` at 128 bits; matching the PKCE verifier entropy budget removes nonce as the weakest link in the flow.
2. **dev-admin bypass behind a feature flag.** `src/hooks/auth.rs::initial_auth_context` was gated on `cfg(debug_assertions)` alone, so a debug WASM that shipped to staging by accident (CI mishap, operator build) auto-signed the user in as Admin from compile-time `ADMIN_EMAIL`/`ADMIN_PASSWORD`. New `dev_admin_bypass` feature is OFF by default even in debug builds; dev devs opt in via `cargo run --features dev_admin_bypass`.
3. **PendingFlow TTL.** `src/modules/oidc/storage.rs::PendingFlow` now carries `issued_at_ms`, stamped on `save_pending` and checked on `take_pending`. Flows older than `PENDING_FLOW_TTL_MS` (10 min) are refused, so a week-old tab does not satisfy the OIDC callback. The mint side in `src/modules/oidc/flow.rs` is updated to pass `&mut PendingFlow`; `#[serde(default)]` on the new field keeps existing in-flight session storage rows deserializable (their `issued_at_ms = 0` reads as expired, which forces a clean re-auth).
4. **Runtime CSP from env.** `oci-build/Caddyfile` previously emitted only `Content-Security-Policy: frame-ancestors 'none'` because `connect-src` depends on `MOKOSH_API_BASE` / `MOKOSH_OIDC_ISSUER` (set by the entrypoint at container start and unknown at build time). Caddy's `{$VAR:-default}` expands at startup, so the same image now ships a full CSP (`default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; connect-src 'self' {$MOKOSH_API_BASE:-} {$MOKOSH_OIDC_ISSUER:-}; ...`) that pins the SPA's exfil surface. When the env vars are empty the directive collapses to `'self'` for those sources, which is correct for the same-origin (host-prefix-derived) case.

#MAPPS-338
YousifShkara deleted branch fix/MAPPS-338-spa-hardening-cluster 2026-06-30 06:01:13 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-apps!384
No description provided.