-
Notifications
You must be signed in to change notification settings - Fork 20
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Security: /auth/authorize validates the request before authenticating, so an unauthenticated user agent can be redirected to a client's URI
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#213 In leodip/goiabada;Unauthenticated callers can drive unbounded audit writes; rate limiting is off by default
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#212 In leodip/goiabada;GenerateSecurityRandomString swallows CSPRNG failure, so no caller can propagate or test it
goPull requests that update Go codePull requests that update Go codeStatus: Open.#211 In leodip/goiabada;Nothing checks that every audit constant is registered in AuditEventTypes
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codeStatus: Open.#209 In leodip/goiabada;Authorize error page renders a hardcoded English heading beside a localized page title
documentationImprovements or additions to documentationImprovements or additions to documentationgoPull requests that update Go codePull requests that update Go codeStatus: Open.#208 In leodip/goiabada;Security: the activation flow compares its code in variable time, and creates the account on a GET
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#207 In leodip/goiabada;Neither server sets http.Server.MaxHeaderBytes, so one request may carry about a megabyte of headers and request line
goPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#205 In leodip/goiabada;A request that panics is logged with status 0, not 500
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codeStatus: Open.#203 In leodip/goiabada;Security: password and OTP form handlers accept their credential from the query string
goPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#202 In leodip/goiabada;Security: no way to find a grant that was cross-bound before #133, once its session row is gone
enhancementNew feature or requestNew feature or requestgoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#199 In leodip/goiabada;StartNewUserSession commits the new session before the work that can still fail, so a late error leaves a row nobody can reach
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codeStatus: Open.#198 In leodip/goiabada;Security: an implicit ceremony receives tokens for a session that was already ended
bugSomething isn't workingSomething isn't workinggoPull requests that update Go codePull requests that update Go codesecuritySecurity issue or hardeningSecurity issue or hardeningStatus: Open.#197 In leodip/goiabada;