Skip to content

Server-side attempt cap bypassed when sessionStorage unavailable #183

Description

@ryota-murakami

Summary

sessionStorage-based attempt counter can be bypassed if storage is unavailable.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

If Safari private mode / quota exceeded, the client always sends attempt=1; the server cap (> 1) never trips, allowing infinite refresh loops.

Fix

Add a server-side short-lived nonce/cookie counter, OR send attempt=2 after first in-memory attempt when storage fails.

Acceptance

  • Server-side enforced cap regardless of client sessionStorage state
  • Tests cover unavailable-storage scenario

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2-mediumPlan for this monthsecuritySecurity vulnerabilities and hardening

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions