fix(session,password,basic)!: close the security audit findings of the session, password and HTTP Basic modules by euskadi31 · Pull Request #120 · hyperscale-stack/security

fix(password): bound stored hash parameters and refuse truncated passwords

euskadi31

committed

cbb552c

fix(basic): verify every attempt against a password hash

euskadi31

committed

8a5d636

fix(basic): parse Basic credentials strictly and name the subject

euskadi31

committed

9412be8

fix(session): require strong keys, bind cookies and enforce the lifetime

euskadi31

committed

28ed02c

fix(session): validate cookie attributes and default to a __Host- cookie

euskadi31

committed

9fc2b98

fix(basic,bearer,session): keep credentials out of fmt, slog and JSON

euskadi31

committed

e22e3b8

fix(session): copies of one session do not make a request ambiguous

euskadi31

committed

efec4f5

fix(examples): stop handing out demo tokens and protect the session-web sign-in

euskadi31

committed

5b4263b

docs: record the session, password and basic invariants for contributors

euskadi31

committed

37b0aec

test(basic,bearer,session): use the generated mockery mocks for interface doubles

euskadi31

committed

d0671ed

fix(session): refuse copies of one session like any two valid sessions

euskadi31

committed

5f5e436

fix(session,examples): keep the sign-in form's session on a dedicated Manager

euskadi31

committed

85773c3

fix(session): report the enforced deadline and fail to the anonymous authentication

euskadi31

committed

4c47736

test(basic): an unavailable hasher answers 503 for every account

euskadi31

committed

3fe8351

test(password): pin the parsing of the argon2id lane count

euskadi31

committed

2bd3736

fix(basic)!: refuse format and separator characters in Basic credentials

euskadi31

committed

37eda17

test(session,basic): pin foreign authentication results, name user-ids

euskadi31

committed

611137e

Navigation Menu

Repository navigation

fix(session,password,basic)!: close the security audit findings of the session, password and HTTP Basic modules - #120

fix(session,password,basic)!: close the security audit findings of the session, password and HTTP Basic modules#120
euskadi31 merged 17 commits into
masterfrom
fix/audit-session-password-basic

Commits on Oct 13, 2026

fix(password): bound stored hash parameters and refuse truncated passwords

fix(basic): verify every attempt against a password hash

fix(basic): parse Basic credentials strictly and name the subject

fix(session): require strong keys, bind cookies and enforce the lifetime

fix(session): validate cookie attributes and default to a __Host- cookie

fix(basic,bearer,session): keep credentials out of fmt, slog and JSON

fix(session): copies of one session do not make a request ambiguous

fix(examples): stop handing out demo tokens and protect the session-web sign-in

docs: record the session, password and basic invariants for contributors

test(basic,bearer,session): use the generated mockery mocks for interface doubles

fix(session): refuse copies of one session like any two valid sessions

fix(session,examples): keep the sign-in form's session on a dedicated Manager

fix(session): report the enforced deadline and fail to the anonymous authentication

test(basic): an unavailable hasher answers 503 for every account

test(password): pin the parsing of the argon2id lane count

fix(basic)!: refuse format and separator characters in Basic credentials

test(session,basic): pin foreign authentication results, name user-ids