diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:13 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:13 +0200 |
| commit | 7d8c774e250b134222374f45726d5426714475de (patch) | |
| tree | d5cf7e7df3131dc51c5c46cc0e8c7ffb4aed0240 /packages/meshbay-client/src/main.js | |
| parent | 99eb93a00269fbfafba7536cf1613b3d4c18c3ce (diff) | |
| download | meshbay-7d8c774e250b134222374f45726d5426714475de.tar.gz | |
fix(hub): enforce registration captcha for every client
The server only checked the captcha when auth_key was absent — but
every real client (browser included, via the password split) sends
auth_key, so the check was off for everyone, and a bot skipped it by
including the field. The Register form still made humans solve a
widget whose token was never transmitted.
Gate is now unconditional on captcha.enabled. The web client
(registerUser in keyderive.js) forwards captcha.token; RegisterPage
resets the (single-use) token on a failed attempt. The desktop client
shares this UI source and is Chromium, so it renders the same widget
(see the paired meshbay-client commit for the CSP change that allows
it).
Tests: test_register_captcha.py.
Third security review, finding M1 (Option A).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG
Diffstat (limited to 'packages/meshbay-client/src/main.js')
0 files changed, 0 insertions, 0 deletions