Repository navigation
feat(auth): CoinPay sign-in audit: nonce + id_token checks, sealed state, Connect/Disconnect (0.21.0) - #354
Merged
Conversation
…ate, Connect/Disconnect (0.21.0) Audit of the existing "Log in with CoinPay" against the STANDING sub rule and the relying-party pattern: - Sub binding was already right (app_metadata.coinpay_sub, never email). - Now sends an OIDC nonce and checks the id_token (iss, aud, exp, nonce) and that userinfo's sub matches it, via @profullstack/coinpay-onboard/oauth; PKCE S256 + client secret on the code exchange as before. - The pending state/verifier/nonce cookie is HMAC-sealed under the client secret and scoped to /api/auth/coinpay (was plain JSON on /). - "Sign in with CoinPay" moved first on /auth. - Settings: Connect CoinPay (POST with the Bearer session; the sealed cookie names the signed-in account) and Disconnect (refused when CoinPay is the only way in: placeholder email, no phone, no passkey). - Tests: forged/edited/expired pending cookie, connect without a session, sub bound elsewhere, disconnect guard, binding ignores email and user_metadata. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| setError(''); | ||
| try { | ||
| const { url } = await api('/api/auth/coinpay/connect', 'POST'); | ||
| window.location.href = url; |
Contributor
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ThreatCrush Security Scan18 finding(s) MEDIUM: 14 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit of qrypt.chat's existing "Log in with CoinPay" (client
cp_b81d8f36449d9c8f36f2f3a0) against the STANDING sub-binding rule and the fleet relying-party pattern.Already right: binds by
app_metadata.coinpay_sub(fixed in #343), never by email; new accounts get<sub>@coinpay.qrypt.chat; PKCE S256 + client secret on the code exchange; session handed over by popup postMessage or a 2-minute/authcookie (not a URL).Fixed here:
noncesent and the id_token checked (iss, aud, exp, nonce) with userinfosubrequired to match, via@profullstack/coinpay-onboard/oauth0.3.1 (finishSignIn)./api/auth/coinpay(was unsigned JSON on/)./auth.POST /api/auth/coinpay/connectwith the Bearer session; the sealed cookie names the signed-in account) and Disconnect (POST /api/auth/coinpay/disconnect, refused when CoinPay is the only way in: placeholder email, no phone, no passkey).GET /api/auth/coinpay/statusfor the card.After deploy: the client's legacy mode gets turned off in CoinPay (
legacy_oauth2=false,require_pkce=true) once a login start is verified.Tests:
tests/coinpay-flow.test.js(new) + existingtests/coinpay-auth.test.js: 31 pass.🤖 Generated with Claude Code