v0.8.0: client/transport rework + handshake hardening, auth profiles, cert/MFA removal#4
Merged
Conversation
…pers - Deleted `createCertificateServerAuth` and `createMultifactorServerAuth` functions from the authentication module. - Updated documentation to reflect the removal of these authentication methods. - Adjusted related tests to remove references to the deleted authentication helpers. - Enhanced JWT server authentication to include version checks for auth payloads. - Improved error handling for invalid maxPending and maxMessageBytes configurations in client and server functions. - Refactored decryption logic to separate AEAD opening from plaintext decoding for better clarity and security.
- Updated `spec-channel-lifecycle.md` and `spec-make-before-break.md` to clarify design documents and implementation status. - Improved validation and error handling in `spec/api.md`, ensuring numeric options are strictly validated and error responses are correctly formatted. - Enhanced the assessment methodology in `spec/assessment.md` to reflect the growing test suite. - Clarified the normative contract in `spec/protocol.md`, emphasizing the importance of strict response formats and the handling of malformed envelopes. - Strengthened security measures in `spec/security.md`, ensuring that authentication processing does not leak sensitive information. - Updated server-side authentication helpers in `src/auth/server.ts` to enforce stricter sanitization on auth payloads. - Improved client-side handling in `src/client.ts` to ensure strict adherence to response formats. - Enhanced router and middleware typing in `src/common.ts` to prevent reserved names from being used. - Added tests for malformed responses and auth payload sanitization in `test/security/malformed-response.test.ts` and `test/unit/auth-server.test.ts`. - Updated typing tests to ensure reserved route names are correctly handled.
…guities - sanitize() now detects reference cycles via WeakSet and rejects them as INVALID_DATA instead of recursing to a host stack overflow; non-cyclic repeated references are still rebuilt independently - protocol.md/api.md: pin CSPRNG requirement, absolute wall-clock deadline checks, maxPending slot accounting, stale/unknown response id drops, malformed current-attempt reply handling, and JWT timestamp sampling - add cyclic-input regression to DoS suite
…tionality security checks
…empts and prevent callback accumulation
…rework and security enhancements
- Introduced a correctness and spec-conformance review for the 0.8.0 release, detailing ten internal findings and proposed fixes. - Created a comprehensive specification vs implementation review, highlighting areas of conformance and discrepancies. - Updated README to include review artifacts and their significance for the 0.8 release line. - Added regression tests for identified review fixes, ensuring that issues related to candidate promotion, handshake timeouts, and middleware behavior are addressed. - Implemented additional tests to validate the handling of reflected server responses and error reporting during handshake attempts.
…calls and updating related tests
…ate related tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.