Skip to content

security-migration-status.md

Latest commit

 

History

History
91 lines (62 loc) · 3.23 KB

security-migration-status.md

File metadata and controls

91 lines (62 loc) · 3.23 KB
Raw

Security Migration Status - OWASP 2026 Compliance

What needs to be done

  • Add Session Tokens to Database (Primary Defense)
    • Store cryptographically random session token (128-bit minimum)
    • Regenerate on login, password change, privilege escalation
    • Validate both user_id AND session_token on every request
    • Implements token denylist pattern for immediate revocation
  • Session Rotation on Login (Session Fixation Protection)
    • Generate new session ID after authentication
    • Invalidate old session tokens
    • OWASP Session Fixation Protection
  • Add Security Audit Fields
    • Track session creation time, last activity, IP address, user agent
    • Detect suspicious activity (IP changes, concurrent sessions)
    • Enable forensic analysis
  • Implement "Logout All Sessions"
    • Allow users to invalidate all sessions globally
    • Critical for compromised account recovery
  • Use UUIDs for User IDs (Defense in Depth)
    • Replace sequential integers with UUIDs
    • Prevents user enumeration attacks

Implementation Details

Database Schema

  • Users table uses UUID (TEXT PRIMARY KEY)
  • Session fields: session_token, session_created_at, session_last_activity, session_ip, session_user_agent
  • All foreign keys updated from INTEGER to TEXT

Security Functions

File: internal/framework/auth/security.go

  • GenerateUUID() - UUID v4 for user IDs
  • GenerateSessionToken() - 128-bit cryptographic session token
  • GenerateCSRFToken() - 256-bit CSRF token

Session Management Methods

File: internal/framework/database/users.go

  • SetUserSessionToken(userID, token, ip, userAgent) - Store session on login
  • ValidateSessionToken(userID, token) - Validate on every request
  • ClearUserSessionToken(userID) - Invalidate on logout/password change
  • ClearAllUserSessions(userID) - "Logout all devices"
  • GetUserSessionInfo(userID) - Audit session metadata

Authentication Flow

File: internal/framework/auth/auth.go

Login() - Generates 128-bit session token, stores in database and cookie

GetUser() - Validates session token from cookie against database (CRITICAL SECURITY)

Logout() - Clears session token from database and invalidates cookie

ChangePassword() - Invalidates session token, forces re-authentication

Security Verification

To verify the security fix:

  1. Delete database: rm -f data/*.db*
  2. Start server: make dev-local
  3. Log in and save cookie
  4. Stop server, delete database, restart
  5. Try to access with old cookie - should FAIL ✅

OWASP 2026 Compliance

✅ Session ID Properties (128-bit cryptographic)

✅ Server-side Validation (database-backed tokens)

✅ Session Rotation (on login/password change)

✅ Immediate Revocation (logout/password change)

✅ Session Metadata (IP, User-Agent for anomaly detection)

✅ UUID User IDs (prevents enumeration)

References