Conversation
Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
… descriptions Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
…rove configuration handling Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
…et auth token key Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
…checks, and improved triggers Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
…onventions Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
⚡ Benchmark ResultsTo add benchmarks, create functions starting with |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| http.SetCookie(w, &http.Cookie{ | ||
| Name: SessionCookieName, | ||
| Value: token, | ||
| Path: "/", | ||
| MaxAge: int(SessionDuration.Seconds()), | ||
| HttpOnly: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| }) |
Check warning
Code scanning / CodeQL
Cookie 'Secure' attribute is not set to true Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix the problem in general, the session cookie must be created with the Secure field set to true, ensuring the browser only sends it over HTTPS. Any related cookie operations (such as clearing the cookie) should use the same security attributes to avoid inconsistent behavior.
The best fix here, without changing existing functionality, is:
- In
SetSessionCookie, addSecure: true,to thehttp.Cookieliteral so the session cookie is HTTPS‑only. - In
ClearSessionCookie, also addSecure: true,so the deletion cookie matches the original cookie’s attributes (name, path, Secure, SameSite, HttpOnly, etc.), ensuring browsers properly remove it.
No new imports or helper methods are needed. All changes are within internal/auth/auth.go, in the SetSessionCookie and ClearSessionCookie functions around lines 155–179.
| @@ -162,6 +162,7 @@ | ||
| MaxAge: int(SessionDuration.Seconds()), | ||
| HttpOnly: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| Secure: true, | ||
| }) | ||
| return token | ||
| } | ||
| @@ -175,6 +176,7 @@ | ||
| MaxAge: -1, | ||
| HttpOnly: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| Secure: true, | ||
| }) | ||
| } | ||
|
|
| http.SetCookie(w, &http.Cookie{ | ||
| Name: SessionCookieName, | ||
| Value: "", | ||
| Path: "/", | ||
| MaxAge: -1, | ||
| HttpOnly: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| }) |
Check warning
Code scanning / CodeQL
Cookie 'Secure' attribute is not set to true Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
In general, the fix is to explicitly set the Secure attribute to true on all session cookies so they are only transmitted over HTTPS. This should be done both when creating the session cookie and when clearing it (the deletion cookie should match the original attributes, including Secure, so that it correctly overwrites the existing cookie in browsers).
Concretely, in internal/auth/auth.go:
- In
SetSessionCookie, update thehttp.Cookieliteral passed tohttp.SetCookieto includeSecure: true,alongsideHttpOnlyandSameSite. - In
ClearSessionCookie, also update thehttp.Cookieliteral to includeSecure: true,so the clearing cookie has the same security attributes as the one that was set.
No new methods or imports are required; Secure is an existing field on http.Cookie from the standard library.
| @@ -161,6 +161,7 @@ | ||
| Path: "/", | ||
| MaxAge: int(SessionDuration.Seconds()), | ||
| HttpOnly: true, | ||
| Secure: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| }) | ||
| return token | ||
| @@ -174,6 +175,7 @@ | ||
| Path: "/", | ||
| MaxAge: -1, | ||
| HttpOnly: true, | ||
| Secure: true, | ||
| SameSite: http.SameSiteStrictMode, | ||
| }) | ||
| } |
|
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
…nter warnings for sensitive logging Signed-off-by: Adrián Constante <ad_con.reload@proton.me>
2 participants
This pull request introduces a comprehensive security model for the Scale Daemon's dashboard and WebSocket configuration, updates CI/CD workflows for improved dependency handling and build checks, and enhances developer experience with new templates and documentation. The most important changes are grouped below by theme:
Security Model & WebSocket Authorization:
README.md.scale_websocket.schema.json) now requires anauthTokenfor config changes and defines error responses for invalid tokens and rate limiting. [1] [2]index.html) injects the WebSocket auth token as a meta tag for use by authenticated sessions.websocket.js) now includes the auth token in config messages and handles new error responses from the server, displaying user-friendly error messages. [1] [2]Authentication UI:
login.html) with error and lockout feedback, supporting the new authentication flow.CI/CD Workflow Improvements:
posterlibrary as a local dependency, patchgo.modto use the local version, and handle cleaning and building accordingly. A new build job is added to produce and summarize Windows binaries. [1] [2] [3] [4].github/codeql-config.ymlfile and referenced in the workflow. [1] [2] [3]Developer Experience:
Miscellaneous:
golang.org/x/sysand addinggolang.org/x/crypto.scale_websocket.schema.jsonand legacy HTML docs. [1] [2]