fix(security): address code & security review findings

- CSRF: SameSite=Strict session cookie + Origin check on unsafe methods
- WebAuthn: require user verification on registration and authentication
- WebAuthn: detect authenticator sign-count regressions (clone protection)
- WebAuthn: Zod-validate authenticator response payloads before verifying
- auth: tie login assertion to the resolved handle's account; persist the
  WebAuthn user id so resident-key resolution maps to the real account
- CSP: drop style-src 'unsafe-inline'; remove third-party font dependency
- resolver: own rate-limit budget, exact key-type match, safe reflection,
  correct reserved/forced-text ordering; mirror type filter on JSON route
- web: distinct error/retry state for profile load failures

Author: MrOplus

apps/server/src/db/repositories.ts

@@ -67,8 +67,7 @@ const stmts = {
 const now = (): string => new Date().toISOString();
 
 export const users = {
-  create(handle: string, displayName: string): UserRow {
-    const id = randomUUID();
+  create(handle: string, displayName: string, id: string = randomUUID()): UserRow {
     const ts = now();
     stmts.insertUser.run(id, handle, handle.toLowerCase(), displayName, ts, ts);
     return stmts.userById.get(id) as UserRow;

apps/server/src/lib/session.ts

@@ -13,7 +13,9 @@ function baseCookieOptions(maxAgeSeconds: number): CookieSerializeOptions {
   return {
     path: '/',
     httpOnly: true,
-    sameSite: 'lax',
+    // Strict: the cookie is only sent for same-site requests, so it can never
+    // ride along on a cross-site request forgery.
+    sameSite: 'strict',
     secure: config.isProduction,
     maxAge: maxAgeSeconds,
   };

apps/server/src/lib/webauthn.ts

@@ -42,7 +42,7 @@ export async function buildRegistrationOptions(params: {
     excludeCredentials: params.existing.map((c) => ({ id: c.id, transports: transportsOf(c) })),
     authenticatorSelection: {
       residentKey: 'preferred',
-      userVerification: 'preferred',
+      userVerification: 'required',
     },
   });
 }
@@ -53,7 +53,7 @@ export async function checkRegistration(params: { response: RegistrationResponse
     expectedChallenge: params.challenge,
     expectedOrigin: origin,
     expectedRPID: rpID,
-    requireUserVerification: false,
+    requireUserVerification: true,
   });
   if (!verification.verified || !verification.registrationInfo) return null;
 
@@ -69,7 +69,7 @@ export async function checkRegistration(params: { response: RegistrationResponse
 export async function buildAuthenticationOptions(credentialsForUser: CredentialRow[]) {
   return generateAuthenticationOptions({
     rpID,
-    userVerification: 'preferred',
+    userVerification: 'required',
     allowCredentials: credentialsForUser.map((c) => ({ id: c.id, transports: transportsOf(c) })),
   });
 }
@@ -84,7 +84,7 @@ export async function checkAuthentication(params: {
     expectedChallenge: params.challenge,
     expectedOrigin: origin,
     expectedRPID: rpID,
-    requireUserVerification: false,
+    requireUserVerification: true,
     credential: {
       id: params.credential.id,
       publicKey: new Uint8Array(Buffer.from(params.credential.public_key, 'base64')),

apps/server/src/plugins/security.ts

@@ -12,12 +12,13 @@ import { config } from '../config.js';
  */
 export async function registerSecurity(app: FastifyInstance): Promise<void> {
   await app.register(helmet, {
-    // The SPA needs inline styles from the bundler and same-origin XHR/WebAuthn.
+    // The bundler emits a linked stylesheet (no inline <style>/style attrs), so
+    // the style policy stays strict; everything is same-origin.
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
         scriptSrc: ["'self'"],
-        styleSrc: ["'self'", "'unsafe-inline'"],
+        styleSrc: ["'self'"],
         imgSrc: ["'self'", 'data:'],
         connectSrc: ["'self'"],
         fontSrc: ["'self'", 'data:'],
@@ -37,6 +38,19 @@ export async function registerSecurity(app: FastifyInstance): Promise<void> {
 
   await app.register(cookie, { secret: config.sessionSecret });
 
+  // CSRF defense: browsers always attach an Origin header to cross-origin
+  // state-changing requests. Reject any unsafe method whose Origin is present
+  // and does not match our own. Non-browser clients (no Origin) are unaffected,
+  // and the SameSite=Strict session cookie provides defence in depth.
+  const UNSAFE = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+  app.addHook('onRequest', async (request, reply) => {
+    if (!UNSAFE.has(request.method)) return;
+    const origin = request.headers.origin;
+    if (origin && origin !== config.publicOrigin) {
+      await reply.code(403).send({ error: 'forbidden', message: 'Cross-origin request rejected.' });
+    }
+  });
+
   await app.register(rateLimit, {
     global: true,
     max: 240,

apps/server/src/plugins/spa.ts

@@ -78,10 +78,12 @@ export async function registerSpa(app: FastifyInstance): Promise<void> {
     const handle = rawParam.endsWith('.keys') ? rawParam.slice(0, -'.keys'.length) : rawParam;
     const forceText = rawParam.endsWith('.keys') || (request.query as { format?: string }).format === 'txt';
 
-    // Reserved single-segment paths belong to the SPA router.
-    if (isReservedHandle(handle)) return sendApp(reply);
-
     const valid = handleSchema.safeParse(handle);
+
+    // Reserved single-segment paths belong to the SPA router, unless plain text
+    // was explicitly requested (in which case there is simply no such handle).
+    if (isReservedHandle(handle) && !forceText) return sendApp(reply);
+
     const user = valid.success ? users.byHandle(valid.data) : undefined;
 
     // Browsers (and unrecognised handles without forced text) get the SPA, which
@@ -90,19 +92,24 @@ export async function registerSpa(app: FastifyInstance): Promise<void> {
 
     reply.type('text/plain; charset=utf-8');
     if (!user) {
-      return reply.code(404).send(`# No SSHID found for "@${handle}"\n`);
+      // Only reflect the handle when it is well-formed; otherwise stay generic.
+      const safe = valid.success ? `"@${valid.data}"` : 'that handle';
+      return reply.code(404).send(`# No SSHID found for ${safe}\n`);
     }
 
+    // Exact (case-insensitive) key-type match, validated against supported types.
     const typeFilter = (request.query as { type?: string }).type?.toLowerCase();
     const lines = sshKeys
       .byUser(user.id)
-      .filter((k) => !typeFilter || k.key_type.toLowerCase().includes(typeFilter))
+      .filter((k) => !typeFilter || k.key_type.toLowerCase() === typeFilter)
       .map((k) => (k.label ? `${k.public_key} ${k.label}` : k.public_key));
 
     return reply.header('cache-control', 'public, max-age=60').send(renderAuthorizedKeys(user.handle, lines));
   };
 
-  app.get('/:handle', resolver);
+  // Public read endpoint: give it its own generous limit so curl polling does
+  // not consume the global per-IP budget shared with the API.
+  app.get('/:handle', { config: { rateLimit: { max: 120, timeWindow: '1 minute' } } }, resolver);
 
   // Deep SPA links (e.g. /dashboard after a hard refresh) — serve the app shell.
   app.setNotFoundHandler({ preHandler: app.rateLimit() }, async (request, reply) => {

apps/server/src/routes/auth.ts

@@ -25,6 +25,22 @@ const registerStartSchema = z.object({
 
 const loginStartSchema = z.object({ handle: handleSchema });
 
+/**
+ * Minimal shape guard for an authenticator response before it is handed to the
+ * WebAuthn verifier. This rejects malformed/oversized payloads early instead of
+ * casting arbitrary JSON straight into the library.
+ */
+const webauthnResponseSchema = z
+  .object({
+    id: z.string().min(1).max(1024),
+    rawId: z.string().min(1).max(1024),
+    type: z.literal('public-key'),
+    response: z.record(z.unknown()),
+    clientExtensionResults: z.record(z.unknown()).optional(),
+    authenticatorAttachment: z.string().optional(),
+  })
+  .passthrough();
+
 /**
  * Passkey (WebAuthn) registration and authentication.
  *
@@ -74,15 +90,22 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(409).send({ error: 'handle_taken', message: 'That handle is already registered.' });
     }
 
+    const body = webauthnResponseSchema.safeParse(request.body);
+    if (!body.success) {
+      return reply.code(400).send({ error: 'invalid_request', message: 'Malformed registration response.' });
+    }
+
     const verified = await checkRegistration({
-      response: request.body as RegistrationResponseJSON,
+      response: body.data as unknown as RegistrationResponseJSON,
       challenge: challenge.challenge,
     });
     if (!verified) {
       return reply.code(400).send({ error: 'verification_failed', message: 'Passkey could not be verified.' });
     }
 
-    const user = users.create(challenge.handle, challenge.displayName ?? '');
+    // Reuse the id encoded into the credential's userHandle so resident-key
+    // resolution maps back to this exact account.
+    const user = users.create(challenge.handle, challenge.displayName ?? '', challenge.userId);
     credentials.create({
       id: verified.id,
       userId: user.id,
@@ -117,17 +140,34 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(400).send({ error: 'challenge_expired', message: 'Login session expired. Try again.' });
     }
 
-    const response = request.body as AuthenticationResponseJSON;
+    const body = webauthnResponseSchema.safeParse(request.body);
+    if (!body.success) {
+      return reply.code(400).send({ error: 'invalid_request', message: 'Malformed authentication response.' });
+    }
+    const response = body.data as unknown as AuthenticationResponseJSON;
+
     const credential = credentials.byId(response.id);
     if (!credential) {
       return reply.code(401).send({ error: 'unknown_credential', message: 'Passkey not recognised.' });
     }
 
+    // The credential must belong to the account the handle resolved to. This ties
+    // the assertion to the handle the user actually typed at login/options.
+    if (!challenge.userId || credential.user_id !== challenge.userId) {
+      return reply.code(401).send({ error: 'verification_failed', message: 'Passkey could not be verified.' });
+    }
+
     const result = await checkAuthentication({ response, challenge: challenge.challenge, credential });
     if (!result) {
       return reply.code(401).send({ error: 'verification_failed', message: 'Passkey could not be verified.' });
     }
 
+    // Cloned-authenticator detection: a counter that fails to advance (when the
+    // authenticator uses one at all) indicates a possible clone or replay.
+    if (credential.counter > 0 && result.newCounter <= credential.counter) {
+      return reply.code(401).send({ error: 'counter_regression', message: 'Passkey rejected (possible clone).' });
+    }
+
     credentials.touch(credential.id, result.newCounter);
     clearChallenge(reply);
     issueSession(reply, credential.user_id);

apps/server/src/routes/publicUser.ts

@@ -19,10 +19,16 @@ export async function publicUserRoutes(app: FastifyInstance): Promise<void> {
       return reply.code(404).send({ error: 'not_found', message: 'No such handle.' });
     }
 
+    // Optional exact key-type filter, mirroring the plain-text resolver.
+    const typeFilter = (request.query as { type?: string }).type?.toLowerCase();
+
     return {
       handle: user.handle,
       displayName: user.display_name,
-      keys: sshKeys.byUser(user.id).map((k) => ({
+      keys: sshKeys
+        .byUser(user.id)
+        .filter((k) => !typeFilter || k.key_type.toLowerCase() === typeFilter)
+        .map((k) => ({
         label: k.label,
         type: k.key_type,
         fingerprint: k.fingerprint,

apps/web/index.html

@@ -17,12 +17,6 @@
       content="Fetch all your SSH public keys with a single handle. Open-source and self-hostable."
     />
     <meta property="og:type" content="website" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&family=JetBrains+Mono:wght@400;500;600&display=swap"
-      rel="stylesheet"
-    />
   </head>
   <body>
     <div id="root"></div>

apps/web/src/pages/Profile.tsx

@@ -9,7 +9,7 @@ import { NotFound } from './NotFound';
 export function Profile() {
   const { handle = '' } = useParams();
   const [profile, setProfile] = useState<PublicProfile | null>(null);
-  const [state, setState] = useState<'loading' | 'ready' | 'missing'>('loading');
+  const [state, setState] = useState<'loading' | 'ready' | 'missing' | 'error'>('loading');
 
   useEffect(() => {
     let active = true;
@@ -23,7 +23,9 @@ export function Profile() {
       })
       .catch((err) => {
         if (!active) return;
-        setState(err instanceof ApiError && err.status === 404 ? 'missing' : 'missing');
+        // A genuine 404 means the handle is unclaimed; anything else (5xx,
+        // network) is a transient error the user can retry.
+        setState(err instanceof ApiError && err.status === 404 ? 'missing' : 'error');
       });
     return () => {
       active = false;
@@ -38,6 +40,22 @@ export function Profile() {
     );
   }
 
+  if (state === 'error') {
+    return (
+      <div className="container-page grid min-h-[calc(100vh-4rem)] place-items-center py-16 text-center">
+        <div className="animate-fade-up">
+          <h1 className="text-2xl font-bold text-white">Couldn’t load this profile</h1>
+          <p className="mx-auto mt-3 max-w-md text-slate-400">
+            Something went wrong reaching the server. Please try again.
+          </p>
+          <button onClick={() => window.location.reload()} className="btn-primary mt-8">
+            Retry
+          </button>
+        </div>
+      </div>
+    );
+  }
+
   if (state === 'missing' || !profile) {
     return <NotFound handle={handle} />;
   }