SSH: account creation and key upload - #1093
Conversation
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
|
Wow, this is so much more elegant than the other attempt. What's left before we merge? |
Right now I'm having it still require users to give a username and email, and just setting their password to a random sequence so if they wanted to later use the website it would require going through the password reset process. I'm not sure if that's the best way to do it or if we would prefer something else. The other part of this is an easier way of adding ssh keys, when doing ssh with a key that is not already affiliated with an account the user is prompted to either create an account or add that key to an existing account and then it generates a link which when followed would add the key. Also not sure if this is a good idea and might have some funny concerns about getting someone to click a link. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 135b68102d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @ssh_key.route("/ssh/link/<token>") | ||
| @authed_only | ||
| def link_ssh_key(token): |
There was a problem hiding this comment.
This route performs account mutation (ssh_keys insert + link consumption) as soon as a logged-in user visits the URL, but it is exposed as a plain GET endpoint. Because browsers automatically send session cookies on top-level cross-site navigations, an attacker can generate a valid link token from SSH onboarding and trick any logged-in victim into opening /ssh/link/<token>, which silently links the attacker's key to the victim's account (account takeover). Use a non-GET confirmation flow (e.g., POST with CSRF token) before persisting the link.
Useful? React with 👍 / 👎.
|
Is this a stale PR? |
Not anymore! Still needs review. I stripped it down to just what I think is needed for account creation to work. |
2 participants
wip