Sign session tokens with HMAC #2

New issue

Open

opened 2026-03-16 21:07:38 +00:00 by austin · 0 comments

austin commented

2026-03-16 21:07:38 +00:00

Owner

Description

CreateSessionToken in internal/auth/oidc.go just base64-encodes a JSON blob with claims and expiry. Anyone who knows the format can forge a session as any user. This is a blocking security issue.

What needs to happen

Generate a random 32-byte secret on first startup. Store it in the data directory as a file, or in a settings table in SQLite. Use HMAC-SHA256 to sign the session payload. Token format becomes base64(payload).base64(signature). On validation, recompute the HMAC and compare.

Uses only the standard library: crypto/hmac, crypto/sha256, crypto/rand.

Consider a SessionManager struct that holds the signing key — both auth modes share it. This is a good learning exercise for understanding how JWTs work conceptually without pulling in a JWT library.

Key files

internal/auth/oidc.go — CreateSessionToken() (line 158) and validateSession() (line 132)
Wherever session logic is extracted to after issue #1

## Description `CreateSessionToken` in `internal/auth/oidc.go` just base64-encodes a JSON blob with claims and expiry. Anyone who knows the format can forge a session as any user. This is a blocking security issue. ## What needs to happen Generate a random 32-byte secret on first startup. Store it in the data directory as a file, or in a `settings` table in SQLite. Use HMAC-SHA256 to sign the session payload. Token format becomes `base64(payload).base64(signature)`. On validation, recompute the HMAC and compare. Uses only the standard library: `crypto/hmac`, `crypto/sha256`, `crypto/rand`. Consider a `SessionManager` struct that holds the signing key — both auth modes share it. This is a good learning exercise for understanding how JWTs work conceptually without pulling in a JWT library. ## Key files - `internal/auth/oidc.go` — `CreateSessionToken()` (line 158) and `validateSession()` (line 132) - Wherever session logic is extracted to after issue #1