fen
d7b51f02b6
The deletion token was accepted via the ?token= query parameter on both
DELETE /api/pastes/{id} and /redeem, and round-tripped through the paste
URL after creation. URL-carried bearer secrets leak into reverse-proxy
access logs and browser history.
- API: deletion tokens are now accepted only via the Authorization header
(Bearer/Token/bare); query params are ignored on both endpoints
- Web create flow: token moves to the browser via a short-lived tok_<id>
HttpOnly cookie instead of the redirect URL; the paste view reads it
from the cookie, never from ?token=
- Web view: the delete button calls redeem() which takes the token from
sessionStorage and sends it as an Authorization header
- Tests: correct token in query must be rejected (403/400); header path
still deletes/redeems; extraction unit cases updated
Fixes #143
46 lines
1.2 KiB
Go
46 lines
1.2 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
|
|
"palette/internal/store"
|
|
)
|
|
|
|
// burnViewerWindow returns the admin-tunable per-viewer dedupe window
|
|
// (#40), falling back to the 15-minute default from #49.
|
|
func (a *apiServer) burnViewerWindow() int {
|
|
if a.settings != nil {
|
|
if m := a.settings.get().BurnViewerWindowMinutes; m > 0 {
|
|
return m
|
|
}
|
|
}
|
|
return 15
|
|
}
|
|
|
|
// handleRedeemDeletion lets a holder of the deletion token hard-delete immediately.
|
|
// DELETE /api/pastes/{id}/redeem with the token in the Authorization header
|
|
// (#143: the ?token= query path was removed so the secret stays out of
|
|
// access logs and browser history).
|
|
func (a *apiServer) handleRedeemDeletion(w http.ResponseWriter, r *http.Request) {
|
|
id := chi.URLParam(r, "id")
|
|
token := deletionAuthorization(r)
|
|
if token == "" {
|
|
writeErr(w, 400, "token required")
|
|
return
|
|
}
|
|
row, err := a.store.GetPaste(id)
|
|
if err != nil || row == nil {
|
|
writeErr(w, 404, "paste not found")
|
|
return
|
|
}
|
|
if row.DeletionToken.String == "" || !store.DeletionTokenEqual(row.DeletionToken.String, token) {
|
|
writeErr(w, 403, "invalid token")
|
|
return
|
|
}
|
|
// hard delete: pastes table row goes away entirely
|
|
a.store.HardDelete(row.ID)
|
|
writeJSON(w, 200, map[string]string{"status": "deleted"})
|
|
}
|