gofix/portal-tunnel-rs
1
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages 1 Wiki Activity Actions

[P1][security] admin 인증 hardening: login rate limit, CSRF/Origin, session cap, audit #31

New issue
Closed
opened 2026-05-02 04:34:07 +00:00 by boxqkrtm · 1 comment
boxqkrtm commented 2026-05-02 04:34:07 +00:00
Copy link

문제

admin session은 random token + cookie 기반이며 HttpOnly/Secure/SameSite=Strict 방향은 좋지만, public-facing 운영 기준으로 추가 hardening이 필요합니다.

관련 후보:

  • crates/portal-relay/src/api/admin.rs
  • crates/portal-relay/src/policy/mod.rs

보강 항목

  • login rate limit / failed login backoff
  • admin session global cap 및 idle/absolute timeout 정리
  • failed login audit log
  • state-changing admin endpoint에 CSRF token 또는 Origin/Referer 검증
  • secret 비교는 직접 구현 대신 subtle crate 등 검증된 constant-time 구현 사용
  • admin secret 파일 권한/길이 정책 문서화 및 검사

완료 기준

  • 반복 login 실패가 rate limit/backoff에 걸림
  • session cap 초과 시 오래된 session 정리 또는 신규 거부
  • state-changing admin 요청에 CSRF/Origin 방어 적용
  • admin auth hardening 테스트 추가

검토 기준: 업로드된 Rust portal-relay 코드 정적 리뷰. 리뷰 환경에서는 cargo check/test/clippy를 실행하지 못했습니다.

## 문제 admin session은 random token + cookie 기반이며 HttpOnly/Secure/SameSite=Strict 방향은 좋지만, public-facing 운영 기준으로 추가 hardening이 필요합니다. 관련 후보: - `crates/portal-relay/src/api/admin.rs` - `crates/portal-relay/src/policy/mod.rs` ## 보강 항목 - login rate limit / failed login backoff - admin session global cap 및 idle/absolute timeout 정리 - failed login audit log - state-changing admin endpoint에 CSRF token 또는 Origin/Referer 검증 - secret 비교는 직접 구현 대신 `subtle` crate 등 검증된 constant-time 구현 사용 - admin secret 파일 권한/길이 정책 문서화 및 검사 ## 완료 기준 - 반복 login 실패가 rate limit/backoff에 걸림 - session cap 초과 시 오래된 session 정리 또는 신규 거부 - state-changing admin 요청에 CSRF/Origin 방어 적용 - admin auth hardening 테스트 추가 --- 검토 기준: 업로드된 Rust `portal-relay` 코드 정적 리뷰. 리뷰 환경에서는 `cargo check/test/clippy`를 실행하지 못했습니다.
gofix commented 2026-05-03 18:58:39 +00:00
Owner
Copy link

수용했습니다. PR #62에서 admin login rate limit/backoff, session cap, failed login audit log, state-changing admin request의 Origin/Referer 검증을 추가했습니다. 검증: cargo test --locked, cargo clippy --locked --all-targets -- -D warnings.

수용했습니다. PR #62에서 admin login rate limit/backoff, session cap, failed login audit log, state-changing admin request의 Origin/Referer 검증을 추가했습니다. 검증: cargo test --locked, cargo clippy --locked --all-targets -- -D warnings.
gofix closed this issue 2026-05-03 18:58:39 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
codex/release-v2.3.2-20260606T133940Z-v2.3.2
codex/release-v2.3.1-20260606T053818Z-v2.3.1
codex/release-v2.3.0-20260601T053029Z-v2.3.0
fix/install-rustls-provider
fix/secure-existing-identity-dir-mode
codex/release-v2.2.5-20260531T135659Z-v2.2.5
codex/release-v2.2.4-20260528T101441Z-v2.2.4
fix/ech-sni-routing
codex/release-v2.2.3-20260520T013605Z-v2.2.3
codex/release-v2.2.2-20260515T172725Z-v2.2.2
codex/v221-upstream-compat
fix/ech-dns-records
feature/upstream-v2.2.0
codex/v219-server-compat
fix/debian-slim-final-stage
fix/disable-kaniko-cache-push
chore/drop-amd64-build
fix/amd64-build-opt-level-2
fix/amd64-build-oom-mitigation
fix/preserve-file-capabilities
chore/derive-release-version-from-env
chore/adopt-k3s-style-versioning
ci/kaniko-multi-arch-images
docs/relay-server-scope
codex/v218-relay-compat
feature/rollback-kaniko-image-build
cleanup/remove-multihop-diagnostics
fix/multihop-kernel-tcp
chore/bump-release-version-dev5
fix/issue-16-delete-zero-hop-route
fix/issue-16-hop-route-first-seen
chore/bump-release-version-dev4
ci/rust-checks
codex/multihop-structured-logs
fix/multihop-hop-route-signature
codex/relay-landing-rust-port-note
ci/multiarch-container-image
chore/release-v2.1.8-rs.dev3
ci/fix-registry-auth
chore/release-v2.1.8-rs.dev2
docs/update-unsupported-features
feature/tls-acme-cloudflare
ci/tagged-container-image
feature/distroless-runtime
feature/public-relays-list
feature/document-unsupported-upstream-features
v2.3.2+rs.1-dev.1
v2.3.1+rs.1
v2.3.1+rs.1-dev.1
v2.3.0+rs.1
v2.3.0+rs.1-dev.1
v2.2.5+rs.1
v2.2.5+rs.1-dev.3
v2.2.5+rs.1-dev.2
v2.2.5+rs.1-dev.1
v2.2.4+rs.1
v2.2.4+rs.1-dev.1
v2.2.3+rs.2
v2.2.3+rs.2-dev.1
v2.2.3+rs.1
v2.2.3+rs.1-dev.1
v2.2.2+rs.2
v2.2.2+rs.2-dev.1
v2.2.2+rs.1
v2.2.2+rs.1-dev.1
v2.2.1+rs.1
v2.2.0+rs.1
v2.1.9+rs.1
v2.1.8+rs.1
v2.1.8-rs.dev5
v2.1.8-rs.dev4
v2.1.8-rs.dev3
v2.1.8-rs.dev2
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
gofix/portal-tunnel-rs#31
No description provided.