cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
1.4 KiB
1.4 KiB
T06 — The identity-provider boundary
Threat model. Someone who controls their own Keycloak account attributes, or who can influence the tokens the application receives, tries to become an operator or to become another person.
Slice. internal/auth/auth.go: LoginHandler, CallbackHandler,
RegistrationHandler, rolesFromIDToken, extractRoles, hasRoleClaimLocation,
idTokenUsableAsHint, validReturnTo, sameOriginReturnTo.
Questions.
- Which of signature, issuer, audience, expiry, and nonce are verified on the ID token? Name any that is not, and say what it would take to exploit it.
- Where exactly does the operator role come from in the token, and which claim locations are accepted? Can a value the user controls on their own account land in that list?
- Is the
stateparameter generated with a CSRF-grade random source, stored, and compared on callback? What happens on mismatch? - Is any token exposed to the browser, stored in a cookie, or logged?
validReturnToandsameOriginReturnToguard the post-login redirect. Try to defeat them: backslashes, encoded characters, protocol-relative forms, userinfo, unicode. Quote the code that would stop each attempt.- If the discovery URL or JWKS endpoint were attacker-controlled, what is the blast radius, and is the issuer pinned in configuration?
Not in scope. Session storage after login (T01).