security(phase-3): token-in-URL fragment, image proxy signed token, bridge RBAC, MCP token sweep, canister CORS lock, path-to-regexp fix
Phase 3 — Defense in Depth (6 items):
3.1 JWT token-in-URL: OAuth redirect uses URL fragment (#token=) instead of query parameter; gateway JWT expiry shortened from 7d to 24h.
3.2 Image proxy: full JWT in ?token= replaced with short-lived HMAC-signed image token (5 min TTL). New /api/v1/vault/image-proxy-token endpoint on both gateway and self-hosted servers.
3.3 Bridge write routes: requireBridgeEditorOrAdmin middleware added to /vault/sync, /index, /memory/store, /memory/clear, /memory/consolidate — viewer role can no longer perform mutations.
3.4 MCP in-memory refresh token store: periodic 10-minute sweep deletes expired entries; destroy() method cleans up timer.
3.5 CORS on canister: corsHeaders() returns stored origin (instead of *) when both gateway_auth_secret and cors_allowed_origin are set. New admin_set_cors_origin function. V7→V8 stable storage migration.
3.6 path-to-regexp ReDoS CVE: npm audit fix upgraded 0.1.12 → 0.1.13 across all three package-lock.json files.
33 new tests in test/phase3-security.test.mjs; 1380 total tests passing.
0 comments
muse hub commit comment sha256:f6120d699345956e6f9665cf263a17baf51c57f1a91258b8a0384a4e1e041a2c --body "your comment"
No comments yet. Be the first to start the discussion.