---
status: complete
phase: 07.4-security-token-fingerprinting-token-binding-inserted
source: [07.4-01-SUMMARY.md, 07.4-02-SUMMARY.md]
started: 2026-06-06T21:00:00Z
updated: 2026-06-06T21:10:00Z
---

## Current Test

[testing complete]

## Tests

### 1. Cold Start Smoke Test
expected: Kill any running server/service. Start the application from scratch. Server boots without errors. Health check returns live response with all services healthy.
result: pass
notes: docker compose stop → rm -f → up -d; backend started clean, no errors in logs. GET /health returned {"status":"ok","checks":{"postgres":"ok","minio":"ok"}}

### 2. Login and normal API access still work
expected: Log in with valid credentials. Access token returned with fgp claim embedded. Protected endpoint returns 200 — fgp embedding is transparent to the user.
result: pass
notes: Login returned ES256 JWT. Decoded payload confirmed fgp="9a27732e18cd110c" present. GET /api/documents with matching User-Agent returned HTTP 200.

### 3. Fingerprint mismatch is rejected
expected: A token replayed from a different User-Agent should return HTTP 401 "Token fingerprint mismatch".
result: pass
notes: Token bound to Mozilla/5.0; replayed with "EvilBot/1.0 (stolen-token-replay)" and different Accept-Language. Response: {"detail":"Token fingerprint mismatch"} HTTP 401. Exact.

### 4. Refresh flow preserved
expected: Refresh endpoint issues a new fgp-bound access token. New token works with same UA, fails with different UA.
result: pass
notes: Refresh returned new JWT with same fgp ("9a27732e18cd110c"). New token: 200 with matching UA, 401 with "AnotherBot/2.0". httpOnly refresh cookie correctly stored with #HttpOnly_ prefix in curl jar.

### 5. FGP test suite passes (5/5)
expected: All FGP integration tests pass with no xfail stubs remaining. Full suite shows no new failures.
result: issue
reported: "4/4 tests passed initially. A concatenation collision vulnerability was found and fixed during UAT. A 5th regression test (FGP-05) was added. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 failed (pre-existing docx ModuleNotFoundError). Final FGP suite: 5/5 passed."
severity: major
notes: Bug found and fixed in same session. See fix commit c77b97b.

## Summary

total: 5
passed: 4
issues: 1
pending: 0
skipped: 0
blocked: 0

## Gaps

- truth: "_compute_fgp must not accept different splits of the same concatenated string as equivalent fingerprints"
  status: fixed
  reason: "User reported: token bound to UA='foobar'+AL='' was accepted by UA='foo'+AL='bar' — same HMAC input without separator"
  severity: major
  test: 5
  root_cause: "Line 91 in backend/services/auth.py: `(user_agent + accept_lang).encode()` — no separator between the two fields allows concatenation collision"
  artifacts:
    - path: "backend/services/auth.py:91"
      issue: "HMAC input lacks separator — user_agent + accept_lang ambiguous"
  missing:
    - "Null-byte separator between user_agent and accept_lang in HMAC input"
    - "Regression test FGP-05 to prevent reintroduction"
  fix_commit: "c77b97b"
  fix_status: "resolved — separator added, regression test added, all 5 FGP tests pass"