curo1305andClaude Sonnet 4.6
fd05563ec6
UAT found and resolved a concatenation collision in _compute_fgp (no separator
between user_agent and accept_lang). Fix committed in c77b97b. All 5 FGP tests
pass. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 pre-existing failure
(test_extract_docx — missing docx module, unrelated to this phase).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
3.1 KiB
status, phase, source, started, updated
| status | phase | source | started | updated | ||
|---|---|---|---|---|---|---|
| complete | 07.4-security-token-fingerprinting-token-binding-inserted |
|
2026-06-06T21:00:00Z | 2026-06-06T21:10:00Z |
Current Test
[testing complete]
Tests
1. Cold Start Smoke Test
expected: Kill any running server/service. Start the application from scratch. Server boots without errors. Health check returns live response with all services healthy. result: pass notes: docker compose stop → rm -f → up -d; backend started clean, no errors in logs. GET /health returned {"status":"ok","checks":{"postgres":"ok","minio":"ok"}}
2. Login and normal API access still work
expected: Log in with valid credentials. Access token returned with fgp claim embedded. Protected endpoint returns 200 — fgp embedding is transparent to the user. result: pass notes: Login returned ES256 JWT. Decoded payload confirmed fgp="9a27732e18cd110c" present. GET /api/documents with matching User-Agent returned HTTP 200.
3. Fingerprint mismatch is rejected
expected: A token replayed from a different User-Agent should return HTTP 401 "Token fingerprint mismatch". result: pass notes: Token bound to Mozilla/5.0; replayed with "EvilBot/1.0 (stolen-token-replay)" and different Accept-Language. Response: {"detail":"Token fingerprint mismatch"} HTTP 401. Exact.
4. Refresh flow preserved
expected: Refresh endpoint issues a new fgp-bound access token. New token works with same UA, fails with different UA. result: pass notes: Refresh returned new JWT with same fgp ("9a27732e18cd110c"). New token: 200 with matching UA, 401 with "AnotherBot/2.0". httpOnly refresh cookie correctly stored with #HttpOnly_ prefix in curl jar.
5. FGP test suite passes (5/5)
expected: All FGP integration tests pass with no xfail stubs remaining. Full suite shows no new failures.
result: issue
reported: "4/4 tests passed initially. A concatenation collision vulnerability was found and fixed during UAT. A 5th regression test (FGP-05) was added. Full suite: 401 passed, 6 skipped, 7 xfailed, 1 failed (pre-existing docx ModuleNotFoundError). Final FGP suite: 5/5 passed."
severity: major
notes: Bug found and fixed in same session. See fix commit c77b97b.
Summary
total: 5 passed: 4 issues: 1 pending: 0 skipped: 0 blocked: 0
Gaps
- truth: "_compute_fgp must not accept different splits of the same concatenated string as equivalent fingerprints"
status: fixed
reason: "User reported: token bound to UA='foobar'+AL='' was accepted by UA='foo'+AL='bar' — same HMAC input without separator"
severity: major
test: 5
root_cause: "Line 91 in backend/services/auth.py:
(user_agent + accept_lang).encode()— no separator between the two fields allows concatenation collision" artifacts:- path: "backend/services/auth.py:91" issue: "HMAC input lacks separator — user_agent + accept_lang ambiguous" missing:
- "Null-byte separator between user_agent and accept_lang in HMAC input"
- "Regression test FGP-05 to prevent reintroduction" fix_commit: "c77b97b" fix_status: "resolved — separator added, regression test added, all 5 FGP tests pass"