Repository navigation
chore(examples): harden the demo's pages and Wallet Provider - #795
Merged
Merged
Conversation
Every passport-vdc server now answers with Content-Security-Policy frame-ancestors 'self' and X-Frame-Options SAMEORIGIN, set by demotls.FrameGuard around the handler demotls.Server serves. The operator pages' forms (revoke, approve, forget) and the verifier's and web wallet's pages could otherwise be clickjacked from a framing page, where their Origin checks pass. Same-origin frames, such as the issuer's progress iframe, still load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The issuer's upload and sample forms now refuse a post whose Origin is another site's, as its review, status, kept-passport and approval forms already do, so another site can't start an offer through a visitor's browser. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… records - /attestation-challenge is limited per client address (a burst of 20, then one a second; 429 past it), so one client can no longer fill the 10,000-challenge table and lock every Android device out. The address is the connection's: no forwarded-address header is trusted, so behind a tunnel the limit is shared. - Keys whose chains end at an untrusted root (an emulator's, or one the sender made) are still remembered for re-attestation, but marked unanchored: at most 1,000 are kept, they're evicted before any anchored key, and one never overwrites an anchored key's record. - The verified keys' file is written at most once every 10 seconds rather than on every record. - A challenge the provider doesn't know now reads "unknown, used or expired; request a new challenge" rather than suggesting forgery. - -require-hardware-key-attestation's help says a key sent without a chain is still attested. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Mark Latest step ran only when the root package released, so a release of sqlstore alone became Latest. It now runs whenever any release is created, marking the root's new tag Latest if it released and otherwise its newest existing release (a vX.Y.Z tag without a component prefix, not a prerelease). Outputs reach the script through env only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
osanderson
force-pushed
the
chore/demo-hardening
branch
from
November 1, 2026 12:43
966961f to
dfb1980
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
passport-vdc
demotls.FrameGuardsendsContent-Security-Policy: frame-ancestors 'self'andX-Frame-Options: SAMEORIGINon every response from every demo server. Before, any site could frame the operator pages, and a form submitted inside a frame passes the pages' Origin checks. Same-origin frames, such as the issuer's progress iframe, still load.POST /attestation-challengeis limited per client address (burst 20, then 1/s, 429 past that). One client can no longer fill the 10,000-challenge table and lock every Android device out. Behind the Cloudflare tunnel all clients share cloudflared's address, so the limit is shared there; the code and README say so.-require-hardware-key-attestationnow says a key sent without a chain is still attested.CI
release-please.yml's Latest step now runs whenever any release is created. It marks the library's newestvX.Y.Zrelease Latest, so a sqlstore-only release no longer takes Latest; ci: keep the library's release marked Latest #789 only covered both releasing together.Test plan
TestPagesRefuseCrossOriginFramingandTestServerGuardsFramingTestOfferForms_RefuseCrossOriginTestEvidence_LimitsChallengesPerClientandTestEvidence_UnanchoredKeysDontDisplace; the challenge message is checked inTestEvidence_VerifiesChainsgo vet ./...,go test -race ./..., pinned gofmt, golangci-lintv0.58.0against this repository🤖 Generated with Claude Code