Add current password verification endpoint#22
Conversation
Add a read-only credential check so client-side vault setup can verify the current account password before persisting encrypted data. Made-with: Cursor
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7df68f6550
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| '/verify-password', | ||
| sessionMw.requireAuth, | ||
| csrfMw.require, | ||
| (req, res) => { |
There was a problem hiding this comment.
POST /auth/verify-password is wired with only requireAuth and CSRF checks, so it exposes an unthrottled 401/204 credential oracle (verifyPasswordStepUp) for any actor who obtains a live session+CSRF token (for example via session theft or XSS). Unlike /auth/change-password, successful guesses here have no user-visible side effect (no password rotation email/session churn), which makes password discovery significantly stealthier and easier to automate; this endpoint should use a limiter (ideally per user/session) similar to other auth-sensitive probes.
Useful? React with 👍 / 👎.
Throttle current-password verification with a session-scoped bucket so abuse of one stolen session cannot block other active sessions for the same user. Made-with: Cursor
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7883fc7482
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| '/verify-password', | ||
| sessionMw.requireAuth, | ||
| csrfMw.require, | ||
| limiters.verifyPassword, |
There was a problem hiding this comment.
createAuthRouter now always injects limiters.verifyPassword into POST /auth/verify-password, but this commit did not make the new key optional. Any caller still passing the previous limiter shape (for example the existing builders in tests/govProposals.routes.test.js that omit verifyPassword) will pass undefined as middleware and fail router construction at startup. This is a backward-incompatible crash path introduced by this change; add a safe default (e.g., disabled limiter) or update all call sites that construct limiters manually.
Useful? React with 👍 / 👎.
Update direct auth-router test mounts so the new verify-password middleware is present in full-suite CI. Made-with: Cursor
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Avoid direct auth-router mount crashes when older test or integration harnesses omit the new verify-password limiter key. Made-with: Cursor
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
POST /auth/verify-passwordas a read-only authenticated credential check.Test plan
Made with Cursor