sutegi 0.8.0 — the production user system (remember me, throttling, CSRF, hash-bound sessions) - #12
Merged
Merged
Conversation
…ing, CSRF, hash-bound sessions Everything Laravel auth scaffolding does, still zero third-party deps: - Remember me (sutegi-auth::remember): selector/validator cookies, only the validator SHA-256 stored, rotation on every use (replayed copies revoke the row), bound to the password hash so password changes kill tokens silently, 30-day server-side expiry. Auth::login_remembered mints; Auth::identify is the handler-side session-or-remember revival point (middleware cannot set cookies on pass-through); logout_from / logout_everywhere revoke. - Login throttling (sutegi-auth::throttle): DB-backed fixed window, 5 attempts / 60 s per key, atomic increments — every pod counts the same. - CSRF: Sessions::csrf get-or-mints a 32-byte token inside the signed session, verify_csrf compares constant-time, require_csrf guards mutating methods (419) while passing reads and Authorization-header callers. - Sessions bound to a password-hash fingerprint: Auth::current/identify treat a stale binding as anonymous — password change logs out every other device. user_id stays pure cookie-HMAC (documented). - Auto-rehash at login when the stored work factor lags the store setting. - require_verified guard; Users::change_password (current-password check), set_name, set_email (resets verified_at). - Tokens: issue_expiring + last_used_at stamping, tolerant table upgrade. - examples/auth exercises remember/revival/throttle/logout end to end. Workspace bumped to 0.8.0; CHANGELOG has the full notes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the gap between
sutegi-authand Laravel's auth scaffolding, still with zero third-party dependencies:sutegi_auth::Remember): selector/validator cookies — only the validator's SHA-256 is stored, the validator rotates on every use (a replayed stolen copy revokes the row, surfacing the theft), tokens are bound to the password hash (password change kills them), server-side 30-day expiry.Auth::identifyis the handler-side revival point;logout_from/logout_everywhererevoke.sutegi_auth::Throttle): DB-backed fixed window (5/60 s per key, atomic increments) — every pod counts the same attempts.Sessions::csrf/verify_csrf(constant-time) + therequire_csrfguard — 419 on mismatch, reads andAuthorization-header callers pass.Auth::loginstamps a fingerprint of the PHC string;current/identifytreat a stale binding as anonymous → password change logs out every other device. Lenient on 0.7 sessions (no fingerprint), strict on mismatch.require_verifiedguard;Users::change_password/set_name/set_email(email change resets verification).Tokens::issue_expiring+last_used_atstamping; in-place table upgrade.examples/authexercises remember/revival/throttle/logout end to end. Workspace bumped to 0.8.0, CHANGELOG updated.Breaking
Authgains a publicremember: Option<Remember<B>>field — struct-literal constructions needremember: None(Auth::newunaffected).Tests
Full workspace green: 86 suites, 0 failures — including 46 sutegi-auth unit tests (rotation chains, theft response, bind kills, throttle windows, CSRF constant-time, revival cookie round-trips).
Consumer
bildu's multi-user system (PR to follow in the-yolo-company/bildu) is built on this release.