myxce/.wolf/bugs/bug-1950.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits	gitea_issue	gitea_synced_status	gitea_synced_hash
bug-1950	fixed	2026-10-10		apiserver	security	2026-10-10T08:15:11Z	2026-10-10T08:15:11Z	1	src/frontend/apiserver/middleware/validatehandler.go	apiserver security jwt		42dd1e7a	381	fixed	edb7a297a683

bug-1950: apiserver JWT validation does not pin the signing algorithm

Description

Observed: (source reading, .kiro/reviews/project-gap-review-2026-10-10.md (P0); to be confirmed by a failing test before the fix) The middleware's parse callback returns the key without checking token.Method (middleware/validatehandler.go:102-104), unlike the other parse path (controllers/auth.go:186).

Expected: Only the configured HMAC algorithm is accepted. Impact: Security hardening: algorithm-confusion class of attacks is not ruled out. Found by: review: .kiro/reviews/project-gap-review-2026-10-10.md (P0)

Environment

• OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
• libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
• Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
• Build: asan (xce.build)
• Code: scheduler-framework @ 94472ee3-dirty
• Deployment: any (found by source reading; the failing test that confirms it is named in Verification)

Reproduction

1. Present a token signed with another algorithm family; validation does not reject it on the algorithm.

• Frequency: deterministic (by code reading; confirmed by the RED test of the fix)
• Evidence: the code sites quoted in Description; no logs kept.

Root cause

isValidToken() (middleware/validatehandler.go) never checked token.Method; GetUsernameFromToken accepted any HMAC variant.

Fix

controllers/auth.go: JWTSigningMethod (HS256), JWTKeyFunc, JWTValidMethods(); both parse paths use them.

Verification

• Test: TestIsValidToken_PinsSigningAlgorithm (middleware/validatehandler_test.go): RED isValidToken(HS384) = true, want false; TestGetUsernameFromToken_PinsSigningAlgorithm: RED; GREEN after.
• Suites: xce-build.sh all asan xce.build --incremental on the merged branch, 2026-10-10: all C suites Ok 155 / Fail 0, frontend Go unit tests ok, xceadmin tests ok; apiserver CGO_ENABLED=0 go test ./... (incl. middleware, router, cmd) ok
• Live: n/a: unit/fixture-level verification only; no live deployment was run (follow-up)

References

• Fix commit: 42dd1e7a (on scheduler-framework; worker-branch original in the merge)
• Review: .kiro/reviews/project-gap-review-2026-10-10.md