Repository navigation
Sign in with CoinPay: bind by sub only, nonce + id_token check, Connect/Disconnect - #144
Merged
Merged
Conversation
…token, Connect/Disconnect - Start sends a nonce with PKCE S256 + state; the callback compares state in constant time and finishes through @profullstack/coinpay-onboard/oauth finishSignIn (secret on the exchange, id_token iss/aud/exp/nonce, userinfo sub must match). - accountIdForCoinpay no longer claims an email-only (affiliate form) account whose email matches the CoinPay email: that let anyone who registered a CoinPay account with your address take the account and its payout wallet. A first CoinPay sign-in gets its own account with an unroutable placeholder email (<sub>@coinpay.moshcoding.invalid); the domain is refused at signup. - Dashboard: Connect CoinPay (needs a password session, /auth/login?mode=connect) and Disconnect (refused when CoinPay is the only sign-in). - Login and signup put Sign in with CoinPay first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
ThreatCrush Security Scan30 finding(s) HIGH/CRITICAL: 2 | MEDIUM: 26 | LOW: 2
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit of moshcoding's existing Sign in with CoinPay against the fleet rule (bind by CoinPay
sub, never by email) and the relying-party pattern.Gaps fixed
nonce, no id_token check, non-constant-time state compare. Now: PKCE S256 + state + nonce, and the callback goes through@profullstack/coinpay-onboard/oauthfinishSignIn(client secret on the exchange; id_token iss/aud/exp/nonce; userinfosubmust match).accountIdForCoinpaybound a CoinPay identity to an existing passwordless account (made by the public affiliate join form) when the emails matched. CoinPay never verifies emails, so anyone could register CoinPay with your address and take that account, including its payout wallet. Now a CoinPay sign-in only ever uses the account bound to its sub, or creates its own with an unroutable placeholder email<sub>@coinpay.moshcoding.invalid(refused at signup/affiliate join)./auth/login?mode=connect, needs a password session) and Disconnect (refused when CoinPay is the only way in; a CoinPay session is moved ontoacct:<id>after disconnect).Affiliate-form accounts that want CoinPay: set a password via Forgot password (email-verified), sign in, then Connect CoinPay.
Tests (
tests/coinpay-signin.test.mjs): email collision does not take a password or affiliate account; connect without a session is refused; forged state rejected; wrong nonce rejected; link/unlink rules.bun test tests/290 pass,tsc --noEmitclean.🤖 Generated with Claude Code