From fac4b143587188d283578bc51e13ca44bcfc6382 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 14:15:26 +0000 Subject: token: a banned node's tokens aren't taken Review finding 11: token::verify checked only that the issuer is a member, and a ban leaves the member entry. A compromised node's tokens stayed valid after it was banned, until it was forgotten too. A token issued by a banned node is now refused (BannedIssuer), as soon as the ban reaches the node judging it. --- docs/access.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'docs') diff --git a/docs/access.md b/docs/access.md index 107de8d..a85dfa4 100644 --- a/docs/access.md +++ b/docs/access.md @@ -106,8 +106,8 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens, by the user (`POST /auth/logout`) or by one who may manage users (`DELETE /admin/users/{name}/tokens`), which sets `_continuum/logouts/`: tokens issued - before aren't taken any more. A token of a node forgotten by the swarm isn't taken - either. In a swarm without a registry, a token is taken until it expires. + before aren't taken any more. A token of a node banned or forgotten by the swarm isn't + taken either. In a swarm without a registry, a token is taken until it expires. * **What it means to trust**: any member could sign a token for any user, as it could write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is the user until it ends, so it goes over TLS only, as passwords do. @@ -307,7 +307,7 @@ A node can be banned: `_continuum/banned/`, written by a user who may w there (protocol data). Every node then leaves its handshakes unanswered, so it is neither synced with nor counted a member, and with the policy every node refuses the changes it commits from then on, judged as the ban stood when they were made (what it -wrote before stays). Deleting the entry lifts the ban. A ban doesn't remove the node +wrote before stays), and the tokens it issued. Deleting the entry lifts the ban. A ban doesn't remove the node from the member list: forget it too (`DELETE /peers/`). ```sh -- cgit v1.3.1