mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-22 16:25:58 +00:00
4d23b2238e
Two tightenings on /auth/native/authorize (a public pre-auth route): - Per-IP pending cap (8): the broker store is capacity-bounded fail-closed at 256 entries with a 600s TTL, so one unauthenticated spammer could fill it and deny native sign-in gateway-wide for the pending window. Pending entries now record the requester IP and each address is capped well above any legitimate concurrent-login count; other addresses keep signing in. - Loopback redirect_uri accepts IP literals only (127.0.0.1 / ::1): 'localhost' can be re-pointed via the hosts file or a hostile resolver (RFC 8252 \u00a78.3 says to use loopback IP literals); the desktop always sends 127.0.0.1, so nothing legitimate used the name. 3 new tests: per-IP cap enforced, cap frees on TTL expiry, localhost redirect rejected at the route. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| audit.py | ||
| base.py | ||
| cookies.py | ||
| login_page.py | ||
| middleware.py | ||
| native_flow.py | ||
| prefix.py | ||
| public_paths.py | ||
| registry.py | ||
| routes.py | ||
| token_auth.py | ||
| ws_tickets.py | ||