Zaki/Password-Manager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mark resolved issues in security-issues.md

Browse Source
This commit is contained in:
Zaki
2026-05-09 22:29:09 +01:00
parent 69b17e4505
commit 49e1ab4730
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security-issues.md
+4 -4
View File
@@ -1,8 +1,8 @@
# Remaining Security Issues # Remaining Security Issues
1. **No rate limiting on `/reauth`** — brute-force possible via export dialog 1. ~~**No rate limiting on `/reauth`** — brute-force possible via export dialog~~ ✅
2. **No Content Security Policy (CSP)** header — XSS could leak crypto key from sessionStorage 2. ~~**No Content Security Policy (CSP)** header — XSS could leak crypto key from sessionStorage~~ ✅
3. **Crypto key in sessionStorage (extractable)** — necessary for refresh persistence, but XSS can steal it. HttpOnly cookie + service worker is more secure but complex 3. **Crypto key in sessionStorage (extractable)** — necessary for refresh persistence, but XSS can steal it. HttpOnly cookie + service worker is more secure but complex
4. **No session rotation** — same token until logout; if leaked, valid for 24h 4. ~~**No session rotation** — same token until logout; if leaked, valid for 24h~~ ✅
5. **No 2FA** — opted out of TOTP implementation 5. **No 2FA** — opted out of TOTP implementation
6. **Password generator modulo bias** — `c.charAt(arr[i] % c.length)` has slight bias when c.length does not divide 2^32; not practically exploitable 6. ~~**Password generator modulo bias** — `c.charAt(arr[i] % c.length)` has slight bias when c.length does not divide 2^32; not practically exploitable~~ ✅