Harden login nonces #473
Merged
Harden login nonces #473
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
HMAC logic looks good to be, only change would be to fail hard If wp_json_encode returns false. The return type is string|false. Tokens not being deleted should be fixed ASAP. |
|
Doh, good catch, thanks! Fixed in 87fdce0 |
3 tasks
kasparsd
reviewed
Oct 17, 2022
|
I'm gonna go ahead and merge this since it seems like everything has been resolved. We can definitely iterate if anyone has any more thoughts though. |
This shortens the attack window, but should still be plenty of time for normal use.
This guarantees that the nonce can only be used by the user it was generated for, and that it can only be used within the same expiration window.
The test only verifies that failing to verify a nonce will delete the valid nonce. It doesn't test that a valid nonce can't be reused.
iandunn
force-pushed
the
harden-login-nonce
branch
from
b153455
to
c129c05
Compare
15 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I noticed a few comments on a closed PR and didn't want them to fall through the cracks:
It also looks like a valid nonce can be reused many times. IMO it should be deleted once it's been successfully used once. The unit test says that it checks for this, but actually checks that an invalid nonce deletes a valid one.I'd appreciate some extra eyes on this one to make sure everything with the HMAC is correct.