sec(auth): fail-closed MFA, CSRF HMAC derivation, bounded last-used, errors.Is (#1018 #1027 #1028 #1029) by cristim · Pull Request #1044 · LeanerCloud/cloud-commitments-cli

sec(auth): verifyTOTP and consumeRecoveryCode fail closed on empty input (#1018)

cristim

committed

a70647d

fix(auth): bound API key last-used updates via singleflight (#1027)

cristim

committed

44f91f2

fix(credentials): use errors.Is for pgx.ErrNoRows sentinel in LoadRaw (#1028)

cristim

committed

5a6df27

sec(auth): derive CSRF token as HMAC-SHA256 of session token, not random (#1029)

cristim

committed

f329841

test(auth,credentials): add regression tests for #1018, #1027, #1028, #1029

cristim

committed

6c40123

fix(credentials): explicit 32-byte key guard + hard error on multi-key config

cristim

committed

ef6314c

fix(secrets): GCP ListSecrets uses client-side HasPrefix, not API filter expression

cristim

committed

dfb66de

sec(oidc): validate Azure exponent range and precise half-configured error

cristim

committed

93f352d

fix(auth): rate-limit password reset requests per email

cristim

committed

7434c11

fix(auth,oidc): L1-L6 low-severity hardening in auth and OIDC subsystems

cristim

committed

47c3b76

fix(auth,credentials): N4 drop pointless SHA-256 in token gen; N5 validate unmarshal fields

cristim

committed

04b9a99

Navigation Menu

Repository navigation

sec(auth): fail-closed MFA, CSRF HMAC derivation, bounded last-used, errors.Is (#1018 #1027 #1028 #1029) - #1044

sec(auth): fail-closed MFA, CSRF HMAC derivation, bounded last-used, errors.Is (#1018 #1027 #1028 #1029)#1044
cristim merged 11 commits into
feat/multicloud-web-frontendfrom
sec/auth-mfa-crypto

Commits on Jun 7, 2026

sec(auth): verifyTOTP and consumeRecoveryCode fail closed on empty input (#1018)

fix(auth): bound API key last-used updates via singleflight (#1027)

fix(credentials): use errors.Is for pgx.ErrNoRows sentinel in LoadRaw (#1028)

sec(auth): derive CSRF token as HMAC-SHA256 of session token, not random (#1029)

test(auth,credentials): add regression tests for #1018, #1027, #1028, #1029

fix(credentials): explicit 32-byte key guard + hard error on multi-key config

fix(secrets): GCP ListSecrets uses client-side HasPrefix, not API filter expression

sec(oidc): validate Azure exponent range and precise half-configured error

fix(auth): rate-limit password reset requests per email

fix(auth,oidc): L1-L6 low-severity hardening in auth and OIDC subsystems

fix(auth,credentials): N4 drop pointless SHA-256 in token gen; N5 validate unmarshal fields