naibaandcloudcode 05e14981b5 fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie ...

- consumeTransferToken now recomputes and constant-time compares the
  entry's HMAC-SHA256; previously the signature was minted but never
  checked, so the documented "防篡改" guarantee was hollow and security
  rested solely on the sync.Map key's randomness.
- CSRF switches from a raw-random double-submit cookie to a signed token
  (nonce.HMAC-SHA256 keyed by JWTSecretKey). The middleware now also
  validates the signature, defeating sibling-subdomain cookie tossing
  where a naive header==cookie pair would otherwise pass.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 05:48:50 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule_pat_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

alertrule.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_legacy_migration_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_optional_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry_race_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_revoke_registry.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_empty_doc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_scope.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_config_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_server_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

api_token.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

batch_move_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

controller.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_cover_validation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_manual_csrf_test.go

fix(cron): switch manual trigger to POST to defeat CSRF

2026-05-26 03:59:50 +00:00

cron_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_service_cover_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron_update_owner_uid_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

cron.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

csrf_signed_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

csrf.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

force_update_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

frontend_fallback_api_tokens_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

frontend_fallback_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

jwt_session_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_audit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_body_limit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_capability_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_capability.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_classify_disabled_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_enable_flag_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_end_to_end_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_kill_switch_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_method_not_allowed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_origin.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_bypass_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_defaults_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_malformed_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit_prune_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_ratelimit.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_sdk_compat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_error_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec_timeout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_exec.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_fs_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_fs.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_meta.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_server_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_tools_server.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_audit_throttle_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_audit_throttle.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_cancel_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_consume_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_correctness_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_data_frame_collision_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_download_finalcheck_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_failure_audit_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_gc_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_no_full_buffer_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_path_cap_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_size_guard_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_spool.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer_token_hmac_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

mcp_transfer_upload_args_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

mcp_transfer.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

mcp.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

nat.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2_csrf_test.go

fix(security): verify transfer-token HMAC and sign CSRF double-submit cookie

2026-05-31 05:48:50 +00:00

oauth2_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

oauth2.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

pat_whitelist_view_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permission_matrix_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

permissions_cover_fanout_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

permissions.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

rest_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_allof_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_doc_consistency_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

scope_doc.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group_update_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server_group.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

server.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_cache_key_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_dispatch_pat_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_list_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_skip_enabled_only_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

service.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_enable_mcp_save_failure_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_enable_mcp_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

setting_reserved_hosts_test.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

setting.go

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

2026-05-31 02:04:35 +00:00

stream_ownership_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

stream_pat_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

tenant_isolation_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

terminal.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_cancel_authz_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_list_filter_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer_retry_authz_test.go

feat: server transfer rotation

2026-05-25 10:17:34 +00:00

transfer_retry_pat_whitelist_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

transfer.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

trigger_task_pat_scope_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

user.go

feat(jwt): server-side session table with keyId + obfuscated uid claims

2026-05-26 03:51:05 +00:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00

ws.go

feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

2026-05-30 15:56:44 +00:00