security: add authentication middleware to validate API credentials #407
Conversation
Add middleware that validates: 1. User has an authenticated session 2. Credentials in request body match session credentials This prevents authenticated users from manipulating credentials to access or modify other users' tasks. - Add middleware/auth.go with AuthMiddleware - Apply auth middleware to all task mutation endpoints - Rate-only endpoints: /auth/*, /api/user, /sync/logs - Auth + rate endpoints: /tasks, /add-task, /edit-task, etc. Co-Authored-By: Claude Opus 4.5 <[email protected]>
|
Thank you for opening this PR! Before a maintainer takes a look, it would be really helpful if you could walk through your changes using GitHub's review tools. Please take a moment to:
More information on how to conduct a self review: This helps make the review process smoother and gives us a clearer understanding of your thought process. Once you've added your self-review, we'll continue from our side. Thank you! |
|
|
||
| // AuthMiddleware validates that the user is authenticated and that request body | ||
| // credentials match the session credentials to prevent unauthorized access. | ||
| func AuthMiddleware(store *sessions.CookieStore) func(http.Handler) http.Handler { |
There was a problem hiding this comment.
seems to work, code is clear as well, but the current approach probably breaks non-browser clients like Postman, or the Flutter App.
The Auth creds validation for the Backend might work for Frontend but can break for Taskwarrior Flutter App, probably we should open an issue there then, to Remove CCSync backend as a way of sync, then replace it with Taskchampion.
The app uses use Taskchampion directly (now), so probably can make it use the CCSync generated creds + the deployed Taskchampion link, bypassing the backend. Can go ahead with this i guess if it works
|
Closing in favor of PR #408 which uses the credential injection approach (preferred). |
Summary
Security Issue Addressed
Missing Authorization on API Endpoints (High) - Previously, task endpoints accepted credentials from the request body without validating them against the authenticated session. An attacker could potentially supply different credentials to access or modify other users' tasks.
Changes
backend/middleware/auth.go: New authentication middleware that:backend/main.go: Apply auth middleware to task endpoints/auth/*,/api/user,/sync/logs/tasks,/add-task,/edit-task,/modify-task,/complete-task,/delete-task,/complete-tasks,/delete-tasksTest plan
🤖 Generated with Claude Code