naibaandcloudcode 05e14981b5 fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie ...

- consumeTransferToken now recomputes and constant-time compares the
  entry's HMAC-SHA256; previously the signature was minted but never
  checked, so the documented "防篡改" guarantee was hollow and security
  rested solely on the sync.Map key's randomness.
- CSRF switches from a raw-random double-submit cookie to a signed token
  (nonce.HMAC-SHA256 keyed by JWTSecretKey). The middleware now also
  validates the signature, defeating sibling-subdomain cookie tossing
  where a naive header==cookie pair would otherwise pass.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 05:48:50 +00:00

..

admin-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

controller

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

rpc

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

user-dist

feat: embed dist

2024-11-29 21:31:39 +08:00

main.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00