Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

sec: issuer claim mandatory — grace period closed

Browse source 
Grace shipped 2026-05-21 for pre-issuer tokens; forward-only removal.
Empty issuer now rejects like a wrong one.
This commit is contained in:
Fimeg 2026-06-11 20:50:27 -04:00
commit 7670594ac3
3 changed files with 3 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

6
server/internal/api/handlers/auth.go
View file

@ -134,16 +134,12 @@ func (h *AuthHandler) WebAuthMiddleware() gin.HandlerFunc {
if claims, ok := token.Claims.(*UserClaims); ok {
// F-A3-12: Validate issuer to prevent cross-type token confusion
if claims.Issuer != "" && claims.Issuer != "redflag-web" {
if claims.Issuer != "redflag-web" {
log.Printf("[WARNING] [server] [auth] wrong_token_issuer expected=redflag-web got=%s", claims.Issuer)
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token type"})
c.Abort()
return
}
// TODO: remove issuer-absent grace period after 30 days
if claims.Issuer == "" {
log.Printf("[WARNING] [server] [auth] web_token_missing_issuer user_id=%s", claims.UserID)
}
c.Set("user_id", claims.UserID)
c.Set("user_role", claims.Role)
c.Next()

1
server/internal/api/handlers/downloads_auth_test.go
View file

@ -146,6 +146,7 @@ func makeTestAgentJWT(t *testing.T, secret string) string {
RegisteredClaims: jwt.RegisteredClaims{
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
IssuedAt: jwt.NewNumericDate(time.Now()),
Issuer: middleware.JWTIssuerAgent,
},
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

6
server/internal/api/middleware/auth.go
View file

@ -70,16 +70,12 @@ func AuthMiddleware() gin.HandlerFunc {
if claims, ok := token.Claims.(*AgentClaims); ok {
// F-A3-12: Validate issuer to prevent cross-type token confusion
if claims.Issuer != "" && claims.Issuer != JWTIssuerAgent {
if claims.Issuer != JWTIssuerAgent {
log.Printf("[WARNING] [server] [auth] wrong_token_issuer expected=%s got=%s", JWTIssuerAgent, claims.Issuer)
c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token type"})
c.Abort()
return
}
// TODO: remove issuer-absent grace period after 30 days (backward compat for deployed agents)
if claims.Issuer == "" {
log.Printf("[WARNING] [server] [auth] agent_token_missing_issuer agent_id=%s", claims.AgentID)
}
c.Set("agent_id", claims.AgentID)
c.Next()
} else {