Apply plan - Authentication gateway cookie signing, login redirect decoding, and SSE transport buffer synchronization in coleam00/Archon
archon · lens architecture · 1 open finding at severity must or above · generated 2026-10-28T15:12:52.112Z
Work top to bottom. Ponder does not edit source - this plan is the handoff.
1. Reverse-proxy authentication service (auth-service/server.js) module.auth.server
auth-service/server.js
f-0001 · must · score 1 · effort xs - signCookie(“authenticated”) signs a static constant with no server-side expiration or credential-rotation binding
In auth-service/server.js:35-50 and 180-185, handleLogin calls signCookie(“authenticated”), which computes HMAC-SHA256(COOKIE_SECRET, “authenticated”) over a static string literal. verifyCookie (lines 40-50, called by handleVerify at line 145) only checks that the HMAC matches “authenticated” and enforces no server-side expiry timestamp and no binding to USERNAME or PASSWORD_HASH. As a result, Max-Age=${COOKIE_MAX_AGE} (line 183) is purely a browser hint (any captured archon_auth cookie header is valid forever against /verify), and rotating AUTH_USERNAME or AUTH_PASSWORD_HASH does not invalidate existing cookies.
Evidence: auth-service/server.js:35-50, auth-service/server.js:145-148, auth-service/server.js:180-185
Do: Add issueSessionCookie and verifySessionCookie in auth-service/server.js signing an expiration unix timestamp and a short HMAC fingerprint of USERNAME:PASSWORD_HASH (authenticated.<exp>.<fingerprint>), verify both in handleVerify, validate COOKIE_MAX_AGE as a positive integer at startup, and add unit tests in auth-service/test.js.
Shape of the work
1 module · 1 finding · effort 1xxs
Generated by Ponder - AI that knows when to speak, and when to shut up.