rbrooks/WeatherBot

Watch

Fork 0

API hardening bundle: OIDC nonce, POST logout, media key validation, honor excluded_event_types on create #70

New issue

Closed

opened 2026-07-18 05:31:33 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-18 05:31:33 +00:00

Contributor

Generate/store/validate OIDC nonce alongside the existing state
handling (app/api/auth.py:126-134, 94-117)
Make logout POST + require_csrf (auth.py:196-201)
Validate media cache_key against ^[A-Za-z0-9_-]+$ and resolve-check
containment in radar_cache_dir (app/api/media.py:22-38)
Persist excluded_event_types in create_location — currently accepted
by the schema and dropped (app/api/locations.py:43-51)

Filed from the 2026-07-17 codebase audit (docs/.internal/report-2026-07-17.md), finding F-31.

- [ ] Generate/store/validate OIDC `nonce` alongside the existing state handling (app/api/auth.py:126-134, 94-117) - [ ] Make logout POST + require_csrf (auth.py:196-201) - [ ] Validate media cache_key against `^[A-Za-z0-9_-]+$` and resolve-check containment in radar_cache_dir (app/api/media.py:22-38) - [ ] Persist `excluded_event_types` in create_location — currently accepted by the schema and dropped (app/api/locations.py:43-51) --- _Filed from the 2026-07-17 codebase audit (`docs/.internal/report-2026-07-17.md`), finding F-31._

claude-bot added this to the v1.0.3 - Security hardening milestone

2026-07-18 05:31:33 +00:00

claude-bot added the

type:security

type:maintenance

labels

2026-07-18 05:31:33 +00:00

rbrooks referenced this issue from a commit

2026-07-18 07:24:46 +00:00

Vendor frontend assets locally; harden public page; POST logout

rbrooks referenced this issue from a commit

2026-07-18 07:24:46 +00:00

Harden auth, media, and public API surfaces

claude-bot referenced this issue

2026-07-18 07:25:01 +00:00

v1.0.3 — Security hardening #93

claude-bot closed this issue

2026-07-18 07:29:29 +00:00

claude-bot commented

2026-07-18 07:30:00 +00:00

Author

Contributor

Fixed in #93 (merged to main). All four items: (1) OIDC login generates a nonce, stored in the session alongside state and validated against the verified ID token's nonce claim on callback (replay/injection defense); (2) logout is now POST /auth/logout guarded by require_csrf — a GET no longer logs out (405); it clears the session and returns the Authentik end-session URL as JSON, which the frontend navigates to top-level (a fetch() can't follow a cross-origin redirect); (3) the media route validates cache_key against ^[A-Za-z0-9_-]+$ and enforces resolved-path containment within the radar cache dir; (4) create_location now persists excluded_event_types (previously accepted by the schema and dropped). Each item has a regression test.

Fixed in #93 (merged to `main`). All four items: (1) OIDC login generates a `nonce`, stored in the session alongside `state` and validated against the verified ID token's `nonce` claim on callback (replay/injection defense); (2) logout is now `POST /auth/logout` guarded by `require_csrf` — a GET no longer logs out (405); it clears the session and returns the Authentik end-session URL as JSON, which the frontend navigates to top-level (a `fetch()` can't follow a cross-origin redirect); (3) the media route validates `cache_key` against `^[A-Za-z0-9_-]+$` and enforces resolved-path containment within the radar cache dir; (4) `create_location` now persists `excluded_event_types` (previously accepted by the schema and dropped). Each item has a regression test.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/WeatherBot#70

No description provided.

Rows
Columns