web: a browser session can mint credentials that outlive it #297

closed cmc opened this on 2026-09-28 08:09 UTC

Discussion

cmc 2026-09-28 08:09 UTC

A browser session can mint credentials that outlive it.

#257 refuses credential-minting commands to a token or SSH key with an expiry. A web session also expires (12 hours idle, 7 days absolute, #276), but web dispatch (internal/httpd/control.go, runControlCode) builds a Ctx with no Expires, so through the settings forms a session can add a non-expiring SSH key, deploy key or runner key, or verify an email. A stolen session cookie can become a permanent SSH key.

Set Ctx.Expires from the session's absolute expiry on web dispatch, so MintsCredential commands are refused the same way; or require a fresh login (re-authentication) for those forms.
Update Threat-Model and Architecture/09-Controls when it lands.

referenced in commit fb6e9dcfa4 by cmc: plans: #287, #284, #298, #285, #297

2026-09-29 00:09 UTC

referenced in commit c2e04ef116 by cmc: wiki: Known-Gaps keeps the open #301 row

2026-09-29 02:25 UTC

closed by cmc in commit 273e9b95f8: wiki: web mints and grants need a sign-in from the last 15 minutes

2026-09-29 02:25 UTC

referenced in commit ab95b83440 by cmc: httpd: the login return path refuses a leading /\

2026-09-29 02:25 UTC

referenced in commit ed8f3378b1 by cmc: web: a stale session's mint or grant gets a sign-in link back to the form

2026-09-29 02:25 UTC

referenced in commit b79de56262 by cmc: control: web mints and grants need a sign-in from the last 15 minutes

2026-09-29 02:25 UTC

referenced in commit 887952c35a by cmc: store: a web session's user carries its sign-in time

2026-09-29 02:25 UTC

referenced in commit 08a24a6e68 by cmc: control: admin repo visibility needs a recent web sign-in

2026-09-29 02:39 UTC

referenced in commit 25279b4b49 by cmc: control: repo settings visibility needs a sign-in from the last 15 minutes

2026-09-29 02:39 UTC

referenced in commit fad7a633f4 by cmc: changelog: one #297 entry, upgrade notes after the list, #298 note corrected

2026-09-29 02:39 UTC