cclohmar/NextMyDay
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
NextMyDay/internal/core
History
Claus Lohmar 93ec8b8131 fix(security): reject replayed TOTP codes 
REVIEW-001 (M0) L5s: a code valid for ±90s could be replayed. TOTP is a
login fallback (D-005) and the only factor the bootstrap admin has (D-041),
so a code observed once (shoulder-surfed, phished, in a log) must not work
twice.

Track the highest accepted counter per identity and refuse any counter that
is not strictly newer. The search is newest-first and compares in constant
time; a replay is reported as ErrInvalidCode — indistinguishable from a wrong
code, so the response is not an oracle (A3). A fresh secret (re-enrollment)
resets the counter.
2026-10-14 11:29:55 +00:00
..
audit feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
auth fix(security): reject replayed TOTP codes 2026-10-14 11:29:55 +00:00
config feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
httpx fix(security): harden httpx — XFF hops, __Host- cookie, isolation headers 2026-10-14 11:29:52 +00:00
mail feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
middleware feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
module feat(module): add the module registry, discovery and the home module (SPEC-008) 2026-10-14 10:53:57 +00:00
recovery feat(recovery): add the admin recovery flow (SPEC-007) 2026-10-14 10:53:53 +00:00
routing feat(routing): add the pure routing model (SPEC-002) 2026-10-14 10:53:48 +00:00
server feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
setup feat(setup): add the /setup bootstrap wizard (SPEC-005) 2026-10-14 10:53:53 +00:00
store feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
users feat(core): add the store, identity plumbing and the door (SPEC-003/004) 2026-10-14 10:53:51 +00:00
web feat(web): add the web shell and the PWA (SPEC-009) 2026-10-14 10:53:57 +00:00