naibaandnaiba/CloudCode fb120074ac chore(security): pin JWT algorithm + SameSite and harden OAuth2 state cookie ...

- Set GinJWTMiddleware.SigningAlgorithm to "HS256" explicitly so a future
  library default change (or an alg:none confusion attempt) cannot weaken
  token validation. This matches the current gin-jwt default, so behaviour
  is unchanged.
- Set CookieSameSite to Lax: same as the modern-browser default, but
  pinned so server-side intent is clear and CSRF on cross-site POST is
  blocked while top-level GET (OAuth callback) still works.
- Move the nz-o2s OAuth2 state cookie into writeOauth2StateCookie and
  set HttpOnly=true. The frontend does not read this cookie, so HttpOnly
  is strictly an XSS-hardening win with no behaviour change.

JWT Cookie HttpOnly/Secure are intentionally left default for now: the
frontend reads \`!!document.cookie\` to display login state and many
deployments terminate TLS at an upstream proxy — flipping those would
require a coordinated frontend change.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

2026-05-18 15:17:59 +00:00

..

waf

fix: add a default error message for waf page (#1145)

2025-12-04 21:52:12 +08:00

alertrule.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

controller.go

fix(controller): restrict waf and online-user listings to admins

2026-05-17 10:24:19 +08:00

cron.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

ddns.go

ddns: support provider hurricane electric (#1036)

2025-03-19 21:52:16 +08:00

fm.go

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

force_update_ownership_test.go

fix(controller): hide foreign server IDs from forceUpdateServer response

2026-05-18 15:16:59 +00:00

jwt_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

jwt.go

chore(security): pin JWT algorithm + SameSite and harden OAuth2 state cookie

2026-05-18 15:17:59 +00:00

nat.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

notification_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

notification.go

feat(notification): add option to convert metric units in request body (#1156)

2026-01-10 17:29:10 +08:00

oauth2.go

chore(security): pin JWT algorithm + SameSite and harden OAuth2 state cookie

2026-05-18 15:17:59 +00:00

permission_matrix_test.go

test: cover multi-user permission boundaries

2026-05-17 10:24:19 +08:00

permissions.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

server_group.go

fix(controller): filter listing endpoints by ownership

2026-05-17 10:24:19 +08:00

server.go

fix(controller): hide foreign server IDs from forceUpdateServer response

2026-05-18 15:16:59 +00:00

service.go

fix(controller): enforce ownership on notification group, NAT server, and batch move

2026-05-17 10:24:19 +08:00

setting.go

feat(v2.0.0): tsdb (#1162)

2026-02-15 13:13:33 +08:00

stream_ownership_test.go

chore(security): pin JWT algorithm + SameSite and harden OAuth2 state cookie

2026-05-18 15:17:59 +00:00

terminal.go

fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack

2026-05-18 15:16:40 +00:00

user.go

fix: member-created services shouldn't be applied to admin resources (#1113)

2025-08-28 22:37:44 +08:00

waf.go

feat(waf): return ip in string literal (#947)

2025-01-04 20:49:14 +08:00

ws_stream_visibility_test.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00

ws.go

fix(ws): scope server stream visibility to viewer ownership

2026-05-17 03:41:28 +00:00