admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4711 - JWT signing key generated by the server; AYANOVA_JWT_SECRET removed

Browse Source 
The LAN/IIS and Linux templates shipped a placeholder secret printed in the
manual, and installs that kept it signed logins with a public key; any setting
also invited short or reused values (security review F1). The setting is now
ignored (one warning at boot if still present): the server generates a key once
(48 random bytes) into jwt-signing.key in the data folder (beside the app if
there is none; owner-only on Linux) and reuses it, so sign-ins also survive a
restart where the server used to make a new key each boot (standalone, Linux
desktop). If the file cannot be used, a temporary key is used for that run.

Templates and dev launch configs drop the setting; manual updated (key page
rewritten, setting steps removed from install pages); changelog line.

Checked locally: token forged with the old placeholder 401; key file created
and reused after restart (old token 200); auth and 2FA tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 12:01:08 -07:00
parent 5bf1f2700a
commit a843bd3132
14 changed files with 61 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
devdocs/modernization/NET10-PORT.md
View File

@@ -178,7 +178,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| Case | Name | Findings |
|---|---|---|
| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41. **Done**: raven `141bdeb8` (proof script 401 on both bypasses; integration test `TwoFactor` in `8e5eec4`); sockeye `f7c1d7c` (same checks on local Sockeye with a temporary user). Sockeye to be deployed to its new droplet by John; 2FA can be turned back on once each server runs the fix |
| 4711 | Placeholder/short JWT secret treated as unset (4698 folded in: random secret generated at install, server ignores a leftover placeholder) | F1 |
| 4711 | JWT secret setting removed: the server generates its signing key once into `jwt-signing.key` in the data folder (4698 folded in) | F1. **Done** (placeholder-forged token 401; key survives restart; auth tests pass). Hosted setup script's secret step now does nothing; tidy later in `sockeye-client` |
| 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
| 4713 | Contact users limited to customer roles | F28 |
| 4715 | Download file names checked (one helper) | F21 |
@@ -205,7 +205,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4654 | General notification delivers at most once per 12 hours (circuit breaker) | 00 |
| 4694 | Standalone launcher not shutting down PostgreSQL (raven-launcher) | 1 |
| 4695 | Shipping the Visual C++ runtime DLLs with the standalone install | 1 |
| 4696 | JWT secret missing from the standalone config.json | 1 |
| 4696 | JWT secret missing from the standalone config.json | 1. Resolved by 4711's server change; confirm on a fresh standalone install |
| 4697 | Relative date filters using the server's time zone | 1 |
| 4699 | Linux desktop data-path note in the manual | 1, docs |
| 4700 | Restore note for customers with a dedicated database role | 1, docs |

2
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -192,7 +192,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
| F41 | **Critical** | **fixed in case 4710** (Sockeye; the business server gets it with 8.3.0) | F5 also in Sockeye (internet-facing admin login) and in the 8.2.x business AyaNova server |
| F42 | High | confirmed (code) | The licence-signing RSA private keys are hardcoded in Sockeye's source and binaries |
| F5 | **Critical** | **fixed in case 4710** | 2FA login step accepts an empty or missing temp token: the password is skipped for users with 2FA on |
| F1 | Critical (installs that kept it) | **confirmed** | Placeholder JWT secret in the LAN/IIS and Linux server config templates |
| F1 | Critical (installs that kept it) | **fixed in case 4711** | Placeholder JWT secret in the LAN/IIS and Linux server config templates |
| F19 | Critical | **confirmed** (import) | Any logged-in user, customer contacts included, can import report templates, whose JavaScript runs in the server's browser |
| F21 | Critical | candidate | Download file names from the URL are not checked: `report/download` and `export/download` may serve files outside the temp folder on Windows |
| F18 | Critical | confirmed (code) | Pick-list search text is put into SQL without escaping; any logged-in user can reach it |