selfpost

Files

T

mixandClaude Opus 5.5 5210cb19f2 auth: the duplicate-cookie line hides a link's token (audit A4)

Security audit 2026-10-17, finding A4 (low), stage 0. The line logged when
a request carries two unprefixed session cookies printed r.URL.Path raw,
so GET /confirm/<token> wrote the token to the log (reachable only with
PANEL_COOKIE_SECURE=false, where a sibling host can plant the bare name).
loggedPath moves from internal/web to internal/web/auth as LoggedPath
(web imports auth, not the other way) and both lines - the origin check's
refusal and the duplicate-cookie one - go through it.

Tests: TestDuplicateCookieLineHidesALinksToken; TestLoggedPathHidesTokens
moved with the function. go test ./internal/web ./internal/web/auth.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 21:35:32 +03:00

auth_test.go

auth: the duplicate-cookie line hides a link's token (audit A4)

2026-10-17 21:35:32 +03:00

auth.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

handlers_test.go

audit 4: sign-in timing and sessions, server timeouts, polling that recovers

2026-10-15 11:07:02 +03:00

handlers.go

auth: the duplicate-cookie line hides a link's token (audit A4)