commit 0e685995a6f6bcb5044c2e999f31bafc4d79a68a · bretton.dev/coves

+22 -19

internal/atproto/oauth/handlers_security.go

···

       10
       10
        
       )

     

       11
       11
        
       

     

       12
       12
        
       // allowedMobileRedirectURIs contains the EXACT allowed redirect URIs for mobile apps.

     

       13
       13
       -
       // SECURITY: Only Universal Links (HTTPS) are allowed - cryptographically bound to app.

     

       13
       13
       +
       //

     

       14
       14
       +
       // Per atproto OAuth spec (https://atproto.com/specs/oauth#mobile-clients):

     

       15
       15
       +
       // - Custom URL schemes are allowed for native mobile apps

     

       16
       16
       +
       // - The scheme must match the client_id hostname in REVERSE-DOMAIN order

     

       17
       17
       +
       // - For client_id https://coves.social/..., the scheme is "social.coves"

     

       18
       18
       +
       //

     

       19
       19
       +
       // We support two redirect URI types:

     

       20
       20
       +
       // 1. Custom scheme: social.coves:/callback (per atproto spec, simpler for mobile)

     

       21
       21
       +
       // 2. Universal Links: https://coves.social/app/oauth/callback (cryptographically bound)

     

       14
       22
        
       //

     

       15
       15
       -
       // Universal Links provide strong security guarantees:

     

       23
       23
       +
       // Universal Links provide stronger security guarantees but require:

     

       16
       24
        
       // - iOS: Verified via /.well-known/apple-app-site-association

     

       17
       25
        
       // - Android: Verified via /.well-known/assetlinks.json

     

       18
       18
       -
       // - System verifies domain ownership before routing to app

     

       19
       19
       -
       // - Prevents malicious apps from intercepting OAuth callbacks

     

       20
       20
       -
       //

     

       21
       21
       -
       // Custom URL schemes (coves-app://, coves://) are NOT allowed because:

     

       22
       22
       -
       // - Any app can register the same scheme and intercept tokens

     

       23
       23
       -
       // - No cryptographic binding to app identity

     

       24
       24
       -
       // - Token theft is trivial for malicious apps

     

       25
       25
       -
       //

     

       26
       26
       -
       // See: https://atproto.com/specs/oauth#mobile-clients

     

       27
       26
        
       var allowedMobileRedirectURIs = map[string]bool{

     

       28
       28
       -
       	// Universal Links only - cryptographically bound to app

     

       27
       27
       +
       	// Custom scheme per atproto spec (reverse-domain of coves.social)

     

       28
       28
       +
       	"social.coves:/callback":                  true,

     

       29
       29
       +
       	"social.coves://callback":                 true, // Some platforms add double slash

     

       30
       30
       +
       	"social.coves:/oauth/callback":            true, // Alternative path

     

       31
       31
       +
       	"social.coves://oauth/callback":           true,

     

       32
       32
       +
       	// Universal Links - cryptographically bound to app (preferred for security)

     

       29
       33
        
       	"https://coves.social/app/oauth/callback": true,

     

       30
       34
        
       }

     

       31
       35
        
       

     

       32
       36
        
       // isAllowedMobileRedirectURI validates that the redirect URI is in the exact allowlist.

     

       33
       33
       -
       // SECURITY: Exact URI matching prevents token theft by rogue apps that register the same scheme.

     

       37
       37
       +
       // SECURITY: Exact URI matching prevents token theft by rogue apps.

     

       34
       38
        
       //

     

       35
       35
       -
       // Custom URL schemes are NOT cryptographically bound to apps:

     

       36
       36
       -
       // - Any app on the device can register "coves-app://" or "coves://"

     

       37
       37
       -
       // - A malicious app can intercept deep links intended for Coves

     

       38
       38
       -
       // - Without exact URI matching, the attacker receives the sealed token

     

       39
       39
       +
       // Per atproto OAuth spec, custom schemes must match the client_id hostname

     

       40
       40
       +
       // in reverse-domain order (social.coves for coves.social), which provides

     

       41
       41
       +
       // some protection as malicious apps would need to know the specific scheme.

     

       39
       42
        
       //

     

       40
       40
       -
       // This function performs EXACT matching (not scheme-only) as a security measure.

     

       41
       41
       -
       // For production, migrate to Universal Links (iOS) or App Links (Android).

     

       43
       43
       +
       // Universal Links (https://) provide stronger security as they're cryptographically

     

       44
       44
       +
       // bound to the app via .well-known verification files.

     

       42
       45
        
       func isAllowedMobileRedirectURI(redirectURI string) bool {

     

       43
       46
        
       	// Normalize and check exact match

     

       44
       47
        
       	return allowedMobileRedirectURIs[redirectURI]

+16 -9

internal/atproto/oauth/handlers_test.go

···

       171
       171
        
       }

     

       172
       172
        
       

     

       173
       173
        
       // TestIsMobileRedirectURI tests mobile redirect URI validation with EXACT URI matching

     

       174
       174
       -
       // Only Universal Links (HTTPS) are allowed - custom schemes are blocked for security

     

       174
       174
       +
       // Per atproto spec, custom schemes must match client_id hostname in reverse-domain order

     

       175
       175
        
       func TestIsMobileRedirectURI(t *testing.T) {

     

       176
       176
        
       	tests := []struct {

     

       177
       177
        
       		uri      string

     

       178
       178
        
       		expected bool

     

       179
       179
        
       	}{

     

       180
       180
       -
       		{"https://coves.social/app/oauth/callback", true}, // Universal Link - allowed

     

       181
       181
       -
       		{"coves-app://oauth/callback", false},             // Custom scheme - blocked (insecure)

     

       182
       182
       -
       		{"coves://oauth/callback", false},                 // Custom scheme - blocked (insecure)

     

       183
       183
       -
       		{"coves-app://callback", false},                   // Custom scheme - blocked

     

       184
       184
       -
       		{"coves://oauth", false},                          // Custom scheme - blocked

     

       185
       185
       -
       		{"myapp://oauth", false},                          // Not in allowlist

     

       186
       186
       -
       		{"https://example.com", false},                    // Wrong domain

     

       187
       187
       -
       		{"http://localhost", false},                       // HTTP not allowed

     

       180
       180
       +
       		// Custom scheme per atproto spec (reverse domain of coves.social)

     

       181
       181
       +
       		{"social.coves:/callback", true},

     

       182
       182
       +
       		{"social.coves://callback", true},

     

       183
       183
       +
       		{"social.coves:/oauth/callback", true},

     

       184
       184
       +
       		{"social.coves://oauth/callback", true},

     

       185
       185
       +
       		// Universal Link - allowed (strongest security)

     

       186
       186
       +
       		{"https://coves.social/app/oauth/callback", true},

     

       187
       187
       +
       		// Wrong custom schemes - not reverse-domain of coves.social

     

       188
       188
       +
       		{"coves-app://oauth/callback", false},

     

       189
       189
       +
       		{"coves://oauth/callback", false},

     

       190
       190
       +
       		{"coves.social://callback", false}, // Not reversed

     

       191
       191
       +
       		{"myapp://oauth", false},

     

       192
       192
       +
       		// Wrong domain/scheme

     

       193
       193
       +
       		{"https://example.com", false},

     

       194
       194
       +
       		{"http://localhost", false},

     

       188
       195
        
       		{"", false},

     

       189
       196
        
       		{"not-a-uri", false},

     

       190
       197
        
       	}