Security audit fixes + usage metering + Caddy WS fix#15
Merged
Conversation
Security fixes:
- relay: never return magic-link token in /auth/magic response (account
takeover); gate behind TUNR_DEV_MODE. Block /auth/verify JWT minting when
no DB unless dev mode. Rate-limit /auth/magic per IP.
- relay: fix WebSocket CheckOrigin suffix bypass ("eviltunr.sh") on
/tunnel/connect & /tunnel/tcp — use host-parsing browserTunnelCheckOrigin.
- relay: bound rate-limiter bucket map (maxBuckets) + opportunistic eviction;
report real per-plan X-RateLimit-Limit.
- cli/daemon: implement runCommand (was a stub) so Windows PID detection works.
- cli/api: fix invalid "http://localhost:*" CORS — reflect loopback origins.
Feature:
- relay: real per-user request/bandwidth metering (Registry.RecordRequest/
UserUsage) surfaced via /api/user/{profile,usage} (were hardcoded 0).
Caddy:
- relay/caddy/Caddyfile: drop manual header_up Upgrade/Connection (breaks
WebSocket on Caddy v2; it proxies upgrades natively).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security/correctness fixes from a full audit of both modules, a real dashboard usage-metering feature, and a Caddy WebSocket fix discovered while deploying. All changes build, vet clean, and pass tests (relay with
-race).Security fixes (relay)
/auth/magicno longer returns the login token in its HTTP response. Gated behindTUNR_DEV_MODE./auth/verifyno longer mints a JWT for any token when no DB is configured unlessTUNR_DEV_MODE=1./auth/magicis now per-IP rate limited (token spam / user enumeration / email flood)./tunnel/connect&/tunnel/tcpusedstrings.HasSuffix(origin, "tunr.sh")(acceptseviltunr.sh). Now uses host-parsingbrowserTunnelCheckOrigin.maxBuckets) + opportunistic eviction;X-RateLimit-Limitnow reports the real per-plan value.Security/correctness fixes (CLI)
runCommandstub: implemented (was always returning empty → broke Windows PID detection /tunr stop).Access-Control-Allow-Origin: http://localhost:*with loopback-origin reflection.Feature
Registry.RecordRequest/UserUsage) surfaced via/api/user/profileand/api/user/usage(previously hardcoded0). Daily reset, unit-tested.Caddy
relay/caddy/Caddyfile: removed manualheader_up Upgrade/Connection— these break the WebSocket handshake on Caddy v2 (which proxies upgrades natively). This caused'upgrade' token not found in 'Connection' headerduring deploy.Verified false positives (audit noise, no change)
SELECT … FOR UPDATE.alg=HS256+ required expiry.Deploy
Deployed and verified live on the new relay server (Docker Compose: postgres + relay + Caddy w/ Let's Encrypt wildcard).
relay.tunr.sh/health200, WS/tunnel/connect101, end-to-end tunnel verified, Paddle webhook 401 on unsigned. Seedocs/DEPLOY_DOCKER.md(local; docs/ is gitignored).🤖 Generated with Claude Code