mirror of https://github.com/dpup/meshstream.git synced 2026-03-28 17:42:37 +01:00

Files

Daniel Pupius 9e5fd5bcae Add code review findings as todos

Security and architecture review of current codebase. 11 findings:
- 3 P1 (XSS, hardcoded creds, unbounded memory growth)
- 4 P2 (SSE protocol, broker deadlock, NetworkMap architecture, CORS)
- 4 P3 (security headers, error leakage, dead code, binary payload)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-15 15:41:24 +00:00

1.9 KiB

Raw Blame History

status, priority, issue_id, tags, dependencies

status

priority

issue_id

Wildcard CORS + No Authentication on SSE Endpoint

Problem Statement

/api/stream sets Access-Control-Allow-Origin: *, meaning any JavaScript on any origin can subscribe to the full decoded packet feed. There is no authentication at any layer. The /api/status endpoint also exposes the MQTT server hostname and subscribed topic to any caller.

Findings

File: server/server.go, line ~182
w.Header().Set("Access-Control-Allow-Origin", "*") on the SSE endpoint
No API key, session token, or any auth mechanism
/api/status returns mqttServer and mqttTopic to unauthenticated callers

Proposed Solutions

Option A: Restrict CORS to same-origin or configured origin

Replace * with a configurable MESHSTREAM_ALLOWED_ORIGIN env var. Default to "" (same-origin only).

Effort: Small
Risk: Low (may break cross-origin dev setups — document the env var)

Option B: Add optional static token auth

Add an optional MESHSTREAM_API_TOKEN env var. If set, require Authorization: Bearer <token> or ?token=<token> on all API requests.

Effort: Small-Medium
Risk: Low

Option C: No change for local-only deployments

Document that the server is intended for local/trusted network use only.

Effort: Trivial
Cons: Doesn't protect deployments that are inadvertently exposed
Risk: Medium

Recommended Action

Option A at minimum (restrict CORS origin). Option B if public deployment is expected.

Technical Details

Affected file: server/server.go

Acceptance Criteria

CORS origin is not * in default configuration
CORS origin is configurable via environment variable
Status endpoint does not expose internal MQTT details without auth (or is documented as intentionally public)

Work Log

2026-03-15: Identified by security-sentinel review agent

1.9 KiB Raw Blame History