Security assessment with Claude

Author: sted

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Change Log
 
+## Unreleased
+
+### Added
+* Configurable JWT token expiry (`TokenExpiry` config, default 24h)
+* Configurable error verbosity (`VerboseErrors` config, default true) to control whether database hints/details are returned to clients
+* Security headers middleware (`X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`)
+* Config startup validations: warn on empty JWT secret, reject CORS credentials with wildcard origins, warn on unlimited request body size
+
+### Fixed
+* Fixed parallel test suites port collision (postgrest suite moved to port 8084)
+* SQL injection in `GetPolicies`, `GetDatabasePrivileges`, and `GetPrivileges` — switched from string concatenation to parameterized queries
+* JWT algorithm validation now pinned to HS256 (was accepting any HMAC variant)
+* CORS default changed from wildcard `*` to empty (must be explicitly configured)
+* CORS allowed headers restricted to specific list instead of wildcard
+* Admin `/sessions` endpoint now requires authentication
+* TLS minimum version enforced to TLS 1.2
+* Session keys now use SHA-256 hash instead of raw token strings
+* Removed hardcoded JWT secret from sample config
+
+### Improved
+* Session improvements and tests
+
 ## 0.5.0 - 2026-04-01
 
 ### Added

api/admin.go

@@ -16,8 +16,6 @@ func InitAdminRouter(apiHelper Helper) {
 	adminURL := apiHelper.BaseAdminURL()
 	admin_db := router.Group(adminURL, apiHelper.MiddlewareStd())
 	admin_dbe := router.Group(adminURL, apiHelper.MiddlewareDBE())
-	admin_nodb := router.Group(adminURL)
-
 	// ROLES
 
 	roles := admin_db.Group("/roles")
@@ -572,7 +570,7 @@ func InitAdminRouter(apiHelper Helper) {
 
 	// SESSIONS
 
-	admin_nodb.Handle("GET", "/sessions", func(c context.Context, w http.ResponseWriter, r heligo.Request) (int, error) {
+	admin_dbe.Handle("GET", "/sessions", func(c context.Context, w http.ResponseWriter, r heligo.Request) (int, error) {
 		stats := apiHelper.SessionStatistics()
 		return heligo.WriteJSON(w, http.StatusOK, stats)
 	})

api/login.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/sted/heligo"
 	"github.com/sted/smoothdb/authn"
@@ -45,7 +46,7 @@ type AccessTokenResponse struct {
 	WeakPassword         *WeakPasswordError `json:"weak_password,omitempty"`
 }
 
-func InitLoginRoute(apiHelper Helper, loginMode string, authURL string, jwtSecret string) {
+func InitLoginRoute(apiHelper Helper, loginMode string, authURL string, jwtSecret string, tokenExpiry int64) {
 	api := apiHelper.GetRouter()
 
 	api.Handle("POST", "/token", func(c context.Context, w http.ResponseWriter, r heligo.Request) (int, error) {
@@ -60,8 +61,12 @@ func InitLoginRoute(apiHelper Helper, loginMode string, authURL string, jwtSecre
 		case "db":
 			err = database.VerifyAuthN(credentials.Email, credentials.Password)
 			if err == nil {
-				token, _ := authn.GenerateToken(credentials.Email, jwtSecret)
-				resp = AccessTokenResponse{Token: token}
+				var expiry time.Duration
+				if tokenExpiry > 0 {
+					expiry = time.Duration(tokenExpiry) * time.Second
+				}
+				token, _ := authn.GenerateToken(credentials.Email, jwtSecret, expiry)
+				resp = AccessTokenResponse{Token: token, ExpiresIn: int(tokenExpiry)}
 				return heligo.WriteJSON(w, http.StatusOK, resp)
 			} else {
 				return heligo.WriteJSON(w, http.StatusBadRequest, SmoothError{Subsystem: "auth", Message: err.Error()})

api/utils.go

@@ -22,6 +22,13 @@ import (
 	"github.com/sted/smoothdb/database"
 )
 
+var verboseErrors = true
+
+// SetVerboseErrors controls whether full database error details are returned to clients.
+func SetVerboseErrors(v bool) {
+	verboseErrors = v
+}
+
 // SmoothError is the generic struct for error reporting
 type SmoothError struct {
 	Subsystem string `json:"subsystem"`
@@ -69,13 +76,16 @@ func WriteServerError(w http.ResponseWriter, err error) (int, error) {
 		default:
 			status = http.StatusInternalServerError
 		}
-		heligo.WriteJSON(w, status, SmoothError{
+		smoothErr := SmoothError{
 			Subsystem: "database",
 			Message:   dberr.Message,
 			Code:      dberr.Code,
-			Hint:      dberr.Hint,
-			Details:   dberr.Detail,
-		})
+		}
+		if verboseErrors {
+			smoothErr.Hint = dberr.Hint
+			smoothErr.Details = dberr.Detail
+		}
+		heligo.WriteJSON(w, status, smoothErr)
 	} else if errors.Is(err, pgx.ErrNoRows) {
 		status = http.StatusNotFound
 		heligo.WriteHeader(w, status)
@@ -84,7 +94,11 @@ func WriteServerError(w http.ResponseWriter, err error) (int, error) {
 		heligo.WriteJSON(w, status, SmoothError{Subsystem: "auth", Message: err.Error()})
 	} else {
 		status = http.StatusInternalServerError
-		heligo.WriteJSON(w, status, SmoothError{Message: err.Error()})
+		msg := "internal server error"
+		if verboseErrors {
+			msg = err.Error()
+		}
+		heligo.WriteJSON(w, status, SmoothError{Message: msg})
 	}
 	return status, err
 }

authn/auth.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/golang-jwt/jwt/v5"
 	"github.com/golang-jwt/jwt/v5/request"
@@ -37,7 +38,7 @@ func extractAuthHeader(req *http.Request) string {
 
 func parseAuthHeader(tokenString string, secret string) (*Claims, error) {
 	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
-		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+		if token.Method.Alg() != "HS256" {
 			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
 		}
 		return []byte(secret), nil
@@ -52,8 +53,18 @@ func parseAuthHeader(tokenString string, secret string) (*Claims, error) {
 	}
 }
 
-func GenerateToken(role, secret string) (string, error) {
+// GenerateToken creates a signed JWT for the given role.
+// If expiry > 0, the token will include exp and iat claims.
+// If expiry == 0, the token has no expiration (for testing or long-lived tokens).
+func GenerateToken(role, secret string, expiry ...time.Duration) (string, error) {
 	claims := &Claims{Role: role}
+	if len(expiry) > 0 && expiry[0] > 0 {
+		now := time.Now()
+		claims.RegisteredClaims = jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(now.Add(expiry[0])),
+			IssuedAt:  jwt.NewNumericDate(now),
+		}
+	}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(secret))
 }

authn/middleware.go

@@ -2,6 +2,8 @@ package authn
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"net/http"
 
@@ -41,10 +43,12 @@ func (m middleware) acquireSession(ctx context.Context, r heligo.Request,
 		return nil, nil, http.StatusUnauthorized, fmt.Errorf("unauthorized access")
 	}
 	dbname := getDBName(ctx, r)
-	key := tokenString + "; "
+	keyInput := tokenString + "; "
 	if !forceDBE {
-		key += dbname
+		keyInput += dbname
 	}
+	h := sha256.Sum256([]byte(keyInput))
+	key := hex.EncodeToString(h[:])
 	session, isNewSession := m.SessionManager().getSession(key)
 	if isNewSession {
 		if tokenString != "" {

database/grants.go

@@ -97,11 +97,13 @@ func GetDatabasePrivileges(ctx context.Context, dbname string) ([]Privilege, err
 	privileges := []Privilege{}
 
 	query := privilegesDatabaseQuery
+	var args []any
 	if dbname != "" {
-		query += " WHERE datname = '" + dbname + "'"
+		query += " WHERE datname = $1"
+		args = append(args, dbname)
 	}
 
-	rows, err := conn.Query(ctx, query)
+	rows, err := conn.Query(ctx, query, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -131,15 +133,17 @@ func GetPrivileges(ctx context.Context, targetType string, targetName string) ([
 	privileges := []Privilege{}
 	var query string
 
+	var args []any
 	if targetType == "table" { // @@ table includes views etc for now
 		query = privilegesRelationQuery
 		if targetName != "" {
 			schemaname, tablename := splitTableName(targetName)
-			query += " AND c.relname = '" + tablename + "' AND n.nspname = '" + schemaname + "'"
+			query += " AND c.relname = $1 AND n.nspname = $2"
+			args = append(args, tablename, schemaname)
 		}
 	}
 
-	rows, err := conn.Query(ctx, query)
+	rows, err := conn.Query(ctx, query, args...)
 	if err != nil {
 		return nil, err
 	}

database/policies.go

@@ -45,9 +45,9 @@ func GetPolicies(ctx context.Context, ftablename string) ([]Policy, error) {
 	policies := []Policy{}
 	query := policyQuery
 	schemaname, tablename := splitTableName(ftablename)
-	query += " WHERE c.relname = '" + tablename + "' AND n.nspname = '" + schemaname + "'"
+	query += " WHERE c.relname = $1 AND n.nspname = $2"
 	query += " ORDER BY tablename"
-	rows, err := conn.Query(ctx, query)
+	rows, err := conn.Query(ctx, query, tablename, schemaname)
 	if err != nil {
 		return nil, err
 	}
@@ -85,6 +85,9 @@ func CreatePolicy(ctx context.Context, policy *Policy) (*Policy, error) {
 			create += quote(role)
 		}
 	}
+	// USING and WITH CHECK are SQL expressions by design (like PostgREST RLS policies)
+	// and cannot be parameterized. This is safe because CreatePolicy is only reachable
+	// via the admin API which requires EnableAdminRoute + authentication.
 	if policy.Using != nil {
 		create += " USING (" + *policy.Using + ")"
 	}

server/config.go

@@ -42,6 +42,8 @@ type Config struct {
 	Plugins              []string        `comment:"Ordered list of plugins (default: [])"`
 	ReadTimeout          int64           `comment:"The maximum duration (seconds) for reading the entire request, including the body (default: 60)"`
 	WriteTimeout         int64           `comment:"The maximum duration before timing out writes of the response (default: 60)"`
+	TokenExpiry          int64           `comment:"JWT token expiry in seconds (default: 86400 = 24h, 0 for no expiry)"`
+	VerboseErrors        bool            `comment:"Return full database error details (hint, detail) to clients (default: true)"`
 	RequestMaxBytes      int64           `comment:"Max bytes allowed in requests, to limit the size of incoming request bodies (default: 1M, 0 for unlimited)"`
 	Database             database.Config `comment:"Database configuration"`
 	Logging              logging.Config  `comment:"Logging configuration"`
@@ -63,13 +65,15 @@ func defaultConfig() *Config {
 		BaseAPIURL:           "/api",
 		ShortAPIURL:          false,
 		BaseAdminURL:         "/admin",
-		CORSAllowedOrigins:   []string{"*"},
+		CORSAllowedOrigins:   []string{},
 		CORSAllowCredentials: false,
 		EnableDebugRoute:     false,
 		PluginDir:            "./_plugins",
 		Plugins:              []string{},
 		ReadTimeout:          60,
 		WriteTimeout:         60,
+		TokenExpiry:          86400,
+		VerboseErrors:        true,
 		RequestMaxBytes:      1024 * 1024,
 		Database:             *database.DefaultConfig(),
 		Logging:              *logging.DefaultConfig(),
@@ -226,6 +230,19 @@ func checkConfig(cfg *Config) error {
 		fmt.Println("Warning: 'ShortAPIURL' requires a single db in 'Database.AllowedDatabases'")
 		cfg.ShortAPIURL = false
 	}
+	if cfg.LoginMode != "none" && cfg.JWTSecret == "" {
+		fmt.Println("Warning: 'JWTSecret' is empty while authentication is enabled (LoginMode:", cfg.LoginMode+")")
+	}
+	if cfg.CORSAllowCredentials {
+		for _, origin := range cfg.CORSAllowedOrigins {
+			if origin == "*" {
+				return fmt.Errorf("invalid CORS configuration: 'CORSAllowCredentials' cannot be true when 'CORSAllowedOrigins' includes '*'")
+			}
+		}
+	}
+	if cfg.RequestMaxBytes == 0 {
+		fmt.Println("Warning: 'RequestMaxBytes' is 0 (unlimited request body size)")
+	}
 	canContinue, err := database.CheckDatabase(&cfg.Database)
 	if err != nil {
 		return err

server/cors.go

@@ -22,7 +22,7 @@ func (s *Server) initCORS() {
 			http.MethodPatch,
 			http.MethodDelete,
 		},
-		AllowedHeaders:   []string{"*"},
+		AllowedHeaders:   []string{"Authorization", "Content-Type", "Accept", "Prefer", "Accept-Profile", "Content-Profile"},
 		AllowCredentials: s.Config.CORSAllowCredentials,
 		MaxAge:           86400,
 	})