lato 3.25.0 → 3.26.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 737de7ae597862df18ec4aa38fce9ac511c884398349122005f9107b2c8904d8
-  data.tar.gz: 2aa2e54234a0cccf18be9343e1132c6d04036126e1fe5ff6b0b0e2c0bdda1729
+  metadata.gz: 59109ceb11a3fb4c78126d99664864266b1d25ac77ff36ef8f6cf3bc5a66ab18
+  data.tar.gz: 7ca6befa9186b81529841c3b25409396beb26b154f99c605557c0b1106e32594
 SHA512:
-  metadata.gz: e08b461f1c18d60decbd7599f009fc90d87f94cb625b987202734f466b3182b997a14a4fc4b200e16daa5f13923fa5237f2004210776d88f9badeccdf3ce2544
-  data.tar.gz: bc865b8d9043e7a07978f8e7a8609244d5189abd7660acf306ecf9d82026c764cd09c4b98304452dfe680822108b42aca8c399ec3d660ef81b04f3bc448f3c77
+  metadata.gz: 33934d542029ce620a7ff4e06c03a2eab2bc7fff362d07237641329724cdac95541b6ea98fb0ad171d84a007705593896a796d2e7648387c4269b22c6812665c
+  data.tar.gz: 5797d50477282510f006e201009aa8c0e7b21dd6c7cadf5e80c0dfbbda8eabbadf88669a06f7425d1d95953ac8ffa2a8ae809dd1333959849805491d3cec6bf8

data/README.md

@@ -5,33 +5,19 @@
 Lato is a Rails Engine that offers a comprehensive web application starter kit with user management, authentication, and UI components for [Ruby on Rails](https://rubyonrails.org/).
 
 This gem includes:
-- User management with **full authentication system** (signin, signup, recover password, email validation, Google Authenticator multi-factor authentication, ETH wallet connection) and **account management** (user settings, password change, email change, etc.);
+- User management with **full authentication system** (signin, signup, recover password, email validation, Google Authenticator and WebAuthn/passkey multi-factor authentication, ETH wallet connection) and **account management** (user settings, password change, email change, etc.);
 - **Web interface** built with [Bootstrap](https://getbootstrap.com/) and [Bootstrap Icons](https://icons.getbootstrap.com/);
 - **UI components integrated with Rails** (data tables, forms, modals, async job executions etc.);
+- **Accessibility built in**: labelled form fields with linked error messages, keyboard friendly modals with focus return, skip link, `aria-sort` on tables, live regions for feedback and WCAG 2.2 target sizes. Core pages report zero axe-core violations on WCAG 2.2 AA rules;
 
 The gem is **agnostic to the application stack**. You can use it with different databases (PostgreSQL, MySQL, SQLite), different Job processors (Solid queue, Sidekiq, Delayed Job, etc.), different cache systems (Redis, Memcached, etc.).
 
 The gem is designed to be easily **customizable and extendable**. You can fully customize the UI and the functionalities of the panel. You can also add new functionalities and components to the panel on the main application or develop new engines to extend the panel.
 
-The gem is ready to be used with the **Rails 8.1.3.1 or later within the 8.1 series** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive, mobile friendly and accessible.
+The gem is ready to be used with the **Rails 8.1.3.1 or later within the 8.1 series** features like **[ESM import maps](https://github.com/rails/importmap-rails)**, **[Turbo](https://turbo.hotwired.dev/)** and **[Stimulus](https://stimulus.hotwired.dev)**. The front-end is designed to be responsive and mobile friendly, with accessibility improvements in progress (see the component notes in the documentation).
 
 <img src="./preview.gif" alt="Lato preview" width="100%">
 
-## Security upgrade
-
-Lato 3.25 requires Rails >= 8.1.3.1 and < 8.2. Install the new session migration before serving requests:
-
-```bash
-bundle exec rails lato:install:migrations
-bundle exec rails db:migrate
-```
-
-Sessions are stored as revocable token hashes in the database. Existing cookies require a fresh sign-in after upgrading. Signing out revokes the current device; changing or recovering a password revokes all devices. Password recovery preserves existing second factors.
-
-Account password, email, authentication factor, wallet, and account deletion changes require the current password plus an enrolled authenticator or security key. Authenticator enrollment requires confirmation with a valid code; an active authenticator's secret is never displayed again. API clients submit `user[current_password]` and, when enrolled, `user[current_authenticator_code]`. Security key clients first POST to `account/security_challenge`, then submit the assertion as `user[current_webauthn_credential]`. Enrollment continuations expire after five minutes and can only be used once.
-
-Extensions updating session attributes must call `session_update(extra_params)` to preserve the revocable session and secure cookie attributes.
-
 ## Full documentation
 
 The full documentation is available here: 👉 👉 [DOCUMENTATION](https://lato-oss.gregoriogalante.com) 👈 👈
@@ -56,13 +42,13 @@ Add required dependencies to your application's Gemfile:
 
 ```ruby
 # Use JavaScript with ESM import maps [https://github.com/rails/importmap-rails]
-gem "importmap-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "importmap-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Hotwire's SPA-like page accelerator [https://turbo.hotwired.dev]
-gem "turbo-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "turbo-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Hotwire's modest JavaScript framework [https://stimulus.hotwired.dev]
-gem "stimulus-rails" # NOTE: Probably already installed in default rails 7+ project
+gem "stimulus-rails" # NOTE: Probably already installed in default Rails 8 project
 
 # Use Sass to process CSS
 gem "sassc-rails"
@@ -90,6 +76,10 @@ rails lato:install:migrations
 rails db:migrate
 ```
 
+Lato stores rate limits, password recovery codes, email verification codes and semaphores in `Rails.cache`. Use a persistent cache shared across processes (Redis, Solid Cache, Memcached): with `:null_store` password recovery never works and rate limits are disabled, with `:memory_store` and multiple processes limits are per process.
+
+To use the Web3 (ETH wallet) authentication add `gem "eth"` to your Gemfile, it is not a dependency of Lato.
+
 Mount lato routes on the **config/routes.rb** file:
 
 ```ruby
@@ -128,6 +118,8 @@ end
 
 ```
 
+Lato ships translations for `it`, `en`, `fr` and `ro`. Any key can be overridden in your application locale files. Emails exist only in Italian and English: users with locale `it` receive Italian emails, every other locale receives English.
+
 ### Extra tasks
 Lato integrates by default a basic PWAs manifest and service worker. To re-generate them with all required assets follow these steps:
 
@@ -151,6 +143,44 @@ rails lato:install:migrations
 rails db:migrate
 ```
 
+### Upgrading to the latest release
+
+- Run `rails lato:install:migrations && rails db:migrate`: the release adds `authenticator_last_used_at` and `webauthn_sign_count` to `lato_users`.
+- `lato_page_head(title)` now escapes the title. Pass an `html_safe` string to render HTML.
+- `lato_form_item_input_check` escapes the label unless it is `html_safe`.
+- `data-turbo-confirm` messages and `data-action-title` are rendered as plain text.
+- New config `Lato.config.auth_password_min_length` (default 8), checked whenever a password is set.
+- Rate limits are stricter: `limit_requests` allows exactly `limit` requests per IP and action, signin is also limited per email (10 failed attempts in 15 minutes) and second factor attempts are counted per user. The pending second factor step expires after 10 minutes or 5 wrong codes.
+- TOTP codes can be used only once and the WebAuthn signature counter is enforced.
+- Web3 signin uses a message bound to host, nonce and issue time (single use, 5 minutes) and requires `gem "eth"`.
+- `switch_locale` redirects only to same-host referers. The GET route `switch_locale_get` is deprecated: use POST `lato.switch_locale_path(locale:)`.
+- `Lato::Operation#start` only starts classes inheriting from `Lato::ApplicationJob`.
+- Schedule the maintenance jobs `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob` (see the operations documentation).
+
+### Upgrading to 3.25
+
+Lato 3.25 requires Rails >= 8.1.3.1 and < 8.2. Install the new session migration before serving requests (`rails lato:install:migrations && rails db:migrate`).
+
+Sessions are stored as revocable token hashes in the database. Existing cookies require a fresh sign-in after upgrading (global logout). Signing out revokes the current device; changing or recovering a password revokes all devices. Password recovery preserves existing second factors and does not disable them.
+
+Account password, email, authentication factor, wallet, and account deletion changes require the current password plus an enrolled authenticator or security key. Authenticator enrollment requires confirmation with a valid code; an active authenticator's secret is never displayed again. API clients submit `user[current_password]` and, when enrolled, `user[current_authenticator_code]`. Security key clients first POST to `account/security_challenge`, then submit the assertion as `user[current_webauthn_credential]`. Enrollment continuations expire after five minutes and can only be used once.
+
+Extensions updating session attributes must call `session_update(extra_params)` to preserve the revocable session and secure cookie attributes.
+
+## Production security checklist
+
+- Set `config.force_ssl = true`: the session cookie is `secure` only when the request is SSL.
+- Use a persistent `Rails.cache` shared across processes (Redis, Solid Cache, Memcached). Recovery codes, verification codes and all rate limits depend on it; Lato logs a warning at boot in production if it is a `NullStore`.
+- Set `config.action_controller.raise_on_open_redirects = true`.
+- Content Security Policy: the Web3 and verify-email views use inline scripts, so those pages need `unsafe-inline` or nonces. `ethers` 5.7.2 is loaded from cdnjs with a dynamic `import()`: pinned to an exact version but without SRI. Vendor it if you need strict supply-chain control.
+- `session_lifetime` (default 30 days) is an absolute lifetime of cookie and database record, with no sliding renewal or idle timeout.
+- WebAuthn: use HTTPS in `webauthn_origin` (a string or an array of origins). There is one credential per user, no backup codes, and user verification is not required.
+- hCaptcha is optional (`hcaptcha_site_key`, `hcaptcha_secret`) and protects signup and password recovery.
+- Schedule `Lato::LatoOperationsCleanerJob` and `Lato::ActiveStorageCleanerJob`, they are not scheduled automatically.
+- Invitations do not expire: destroy pending ones that are no longer needed.
+- `authenticator_secret` is stored in clear in the database: consider Active Record encryption.
+- Signin per-email limiting can be used to temporarily lock a known email: monitor failed signins.
+
 ## Development
 
 Clone repository, install dependencies, run migrations and start:

data/app/assets/javascripts/lato/controllers/lato_account_webauthn_controller.js

@@ -83,11 +83,14 @@ export default class extends Controller {
 
   showError(message) {
     if (this.hasStatusTarget) {
-      this.statusTarget.innerHTML = `
-        <div class="alert alert-danger">
-          <h4 class="alert-heading">${message}</h4>
-        </div>
-      `
+      const alert = document.createElement('div')
+      alert.className = 'alert alert-danger'
+      alert.setAttribute('role', 'alert')
+      const heading = document.createElement('h4')
+      heading.className = 'alert-heading'
+      heading.textContent = message
+      alert.appendChild(heading)
+      this.statusTarget.replaceChildren(alert)
     }
   }
 }

data/app/assets/javascripts/lato/controllers/lato_action_controller.js

@@ -17,6 +17,7 @@ export default class extends Controller {
   connect() {
     this.bsModals = []
     this.usedModals = []
+    this.returnFocusElements = []
 
     this.modalTargets.forEach((modalTarget, index) => {
       this.bsModals.push(new bootstrap.Modal(modalTarget))
@@ -39,10 +40,16 @@ export default class extends Controller {
           }
         }, 1)
       })
+      // Programmatic show() does not restore focus like data-bs-toggle does: give it back to the trigger.
+      modalTarget.addEventListener('hidden.bs.modal', () => {
+        const element = this.returnFocusElements[index]
+        this.returnFocusElements[index] = null
+        if (element && element.isConnected) element.focus()
+      })
       modalTarget.addEventListener('hide.bs.modal', () => {
         setTimeout(() => {
           this.usedModals = this.usedModals.filter((i) => i != index)
-          this.modalBodyTargets[index].innerHTML = ''
+          this.modalBodyTargets[index].replaceChildren()
         }, 500)
       })
     })
@@ -56,12 +63,12 @@ export default class extends Controller {
 
     // clean modalTitle content
     this.modalTitleTargets.forEach((modalTitleTarget) => {
-      modalTitleTarget.innerHTML = ''
+      modalTitleTarget.textContent = ''
     })
 
     // clean modalBody content
     this.modalBodyTargets.forEach((modalBodyTarget) => {
-      modalBodyTarget.innerHTML = ''
+      modalBodyTarget.replaceChildren()
     })
   }
 
@@ -108,19 +115,22 @@ export default class extends Controller {
     const index = this.getFreeModalIndex()
 
     if (options.turboFrame && options.turboFrame != '_top') {
-      this.modalBodyTargets[index].innerHTML = `
-      <turbo-frame id="${options.turboFrame}">
-      <div class="placeholder-glow">
-        ${Array(options.actionRows).fill().map(() => `<span class="placeholder placeholder-lg col-12"></span>`).join('')}
-      </div>
-      </turbo-frame>
-      `
-
-      if (options.actionTitle) {
-        this.modalTitleTargets[index].innerHTML = options.actionTitle
-      } else {
-        this.modalTitleTargets[index].innerHTML = ''
+      // Build nodes instead of HTML strings: frame id and title come from element attributes.
+      const turboFrame = document.createElement('turbo-frame')
+      turboFrame.id = options.turboFrame
+      turboFrame.setAttribute('aria-busy', 'true')
+      turboFrame.addEventListener('turbo:frame-load', () => turboFrame.removeAttribute('aria-busy'), { once: true })
+      const placeholder = document.createElement('div')
+      placeholder.className = 'placeholder-glow'
+      for (let i = 0; i < options.actionRows; i++) {
+        const row = document.createElement('span')
+        row.className = 'placeholder placeholder-lg col-12'
+        placeholder.appendChild(row)
       }
+      turboFrame.appendChild(placeholder)
+      this.modalBodyTargets[index].replaceChildren(turboFrame)
+
+      this.modalTitleTargets[index].textContent = options.actionTitle || ''
 
       if (options.actionSize) {
         this.modalDialogTargets[index].classList.remove('modal-md')
@@ -130,6 +140,7 @@ export default class extends Controller {
         this.modalDialogTargets[index].classList.add(`modal-${options.actionSize}`)
       }
 
+      this.returnFocusElements[index] = document.activeElement
       this.bsModals[index].show()
     }
   }

data/app/assets/javascripts/lato/controllers/lato_confirm_controller.js

@@ -18,36 +18,46 @@ export default class extends Controller {
         if (bsModalBackdropElement) bsModalBackdropElement.style.zIndex = 2000
       }, 1)
     })
+
+    // Any dismissal (backdrop, ESC, close button) must settle the pending confirm, otherwise the form hangs.
+    this.element.addEventListener('hidden.bs.modal', () => {
+      this.resolveConfirm(false)
+      this.modalBodyTarget.textContent = ''
+      // Programmatic show() does not restore focus like data-bs-toggle does: give it back to the trigger.
+      if (this._returnFocusElement && this._returnFocusElement.isConnected) this._returnFocusElement.focus()
+      this._returnFocusElement = null
+    })
   }
 
   disconnect() {
+    this.resolveConfirm(false)
     Turbo.config.forms.confirm = window.confirm
   }
 
-  async customConfirm(message) {
-    this.modalBodyTarget.innerHTML = message
+  customConfirm(message) {
+    this.resolveConfirm(false)
+    this._returnFocusElement = document.activeElement
+    // textContent: the message comes from data-turbo-confirm and may include user data.
+    this.modalBodyTarget.textContent = message
     this.modal.show()
 
-    this._result = undefined
-    while (this._result === undefined) {
-      await new Promise(resolve => setTimeout(resolve, 100))
-    }
-
-    return this._result
+    return new Promise(resolve => { this._resolve = resolve })
   }
 
   confirmSuccess() {
-    this.hideModal()
-    this._result = true
+    this.resolveConfirm(true)
+    this.modal.hide()
   }
 
   confirmCancel() {
-    this.hideModal()
-    this._result = false
+    this.resolveConfirm(false)
+    this.modal.hide()
   }
 
-  hideModal() {
-    this.modal.hide()
-    setTimeout(() => this.modalBodyTarget.innerHTML = '', 500)
+  resolveConfirm(result) {
+    if (!this._resolve) return
+
+    this._resolve(result)
+    this._resolve = null
   }
 }

data/app/assets/javascripts/lato/controllers/lato_copyclip_controller.js

@@ -10,6 +10,18 @@ export default class extends Controller {
     if (this.hasButtonTarget) {
       this.buttonTargetOriginalHTML = this.buttonTarget.innerHTML
     }
+
+    // Live region created up front: screen readers only announce changes to a region already in the DOM.
+    this.statusElement = document.createElement('span')
+    this.statusElement.className = 'visually-hidden'
+    this.statusElement.setAttribute('role', 'status')
+    this.statusElement.setAttribute('aria-live', 'polite')
+    this.element.appendChild(this.statusElement)
+  }
+
+  disconnect() {
+    if (this._copyTimeout) clearTimeout(this._copyTimeout)
+    this.statusElement?.remove()
   }
 
   onButtonClick(e) {
@@ -18,7 +30,7 @@ export default class extends Controller {
     this.copy()
   }
 
-  copy() {
+  async copy() {
     if (!this.hasInputTarget) return
 
     // Copy the text inside the text field
@@ -26,16 +38,22 @@ export default class extends Controller {
     this.inputTarget.setSelectionRange(0, 99999) // For mobile devices
 
     // Copy the text inside the text field
-    navigator.clipboard.writeText(this.inputTarget.value)
+    try {
+      await navigator.clipboard.writeText(this.inputTarget.value)
+    } catch (error) {
+      console.error(error)
+      return
+    }
+
+    const copiedText = (this.hasButtonTarget && this.buttonTarget.dataset.copyText) || 'Copied!'
+    this.statusElement.textContent = copiedText
 
     // Manage button state
-    if (this.hasButtonTarget) {
-      this.buttonTarget.innerHTML = this.buttonTarget.dataset.copyText || 'Copied!'
-      
-      if (this._copyTimeout) clearTimeout(this._copyTimeout)
-      this._copyTimeout = setTimeout(() => {
-        this.buttonTarget.innerHTML = this.buttonTargetOriginalHTML
-      }, 2000)
-    }
+    if (this._copyTimeout) clearTimeout(this._copyTimeout)
+    if (this.hasButtonTarget) this.buttonTarget.textContent = copiedText
+    this._copyTimeout = setTimeout(() => {
+      if (this.hasButtonTarget) this.buttonTarget.innerHTML = this.buttonTargetOriginalHTML
+      this.statusElement.textContent = ''
+    }, 2000)
   }
 }

data/app/assets/javascripts/lato/controllers/lato_form_controller.js

@@ -30,6 +30,7 @@ export default class extends Controller {
   // This event is used to remove the Bootstrap invalid class from the input when the user starts typing.
   onInputChange(e) {
     e.target.classList.remove('is-invalid')
+    e.target.removeAttribute('aria-invalid')
   }
 
   // NOTE: You can use this method to submit the form from outside the form or from custom DOM actions.

data/app/assets/javascripts/lato/controllers/lato_index_controller.js

@@ -1,6 +1,9 @@
 import { Controller } from "@hotwired/stimulus"
 
 export default class extends Controller {
+  static values = {
+    key: String
+  }
 
   /**
    * Stimulus
@@ -15,7 +18,7 @@ export default class extends Controller {
 
   // This event is used to reset the pagination when the user types in the search input to start a new search.
   onSearchKeyUp(e) {
-    const pageInput = this.element.querySelector('input[name="page"]')
+    const pageInput = this.element.querySelector(`input[name="${this.keyValue}_page"]`)
     if (pageInput) pageInput.value = 1
   }
 }

data/app/assets/stylesheets/lato/application.scss

@@ -38,6 +38,20 @@ $tooltip-max-width: 300px;
   margin: 0 4px;
 }
 
+// WCAG 2.2 target size (2.5.8): interactive targets of at least 24x24px.
+.pagination > span > a {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 24px;
+  min-height: 24px;
+}
+
+// Bootstrap's pink code color fails contrast on tinted alert backgrounds.
+.alert code {
+  color: inherit;
+}
+
 .pagination .current {
   font-weight: bold;
 }
@@ -143,6 +157,9 @@ main, aside {
   .btn {
     font-size: 12px;
     padding: 0.15rem 0.3rem;
+    // 25px: btn-group overlaps adjacent buttons by 1px, the visible target must stay >= 24px (WCAG 2.5.8)
+    min-width: 25px;
+    min-height: 24px;
   }
 }
 

data/app/controllers/concerns/lato/componentable.rb

@@ -35,14 +35,7 @@ module Lato
         if collection.respond_to?(:lato_index_search)
           collection = collection.lato_index_search(search)
         else
-          query = @_lato_index[key][:searchable_columns].map do |key|
-            if collection.column_for_attribute(key).type == :string || collection.column_for_attribute(key).type == :text
-              "LOWER(#{key}) LIKE :search"
-            else
-              "CAST(#{key} AS TEXT) LIKE :search"
-            end
-          end
-          collection = collection.where(query.join(' OR '), search: "%#{search.downcase.strip}%")
+          collection = collection.where(lato_index_search_condition(collection, @_lato_index[key][:searchable_columns], search))
         end
       end
 
@@ -64,6 +57,25 @@ module Lato
 
     private
 
+    # Built with Arel so columns are quoted and the CAST type fits the adapter (MySQL has no CAST AS TEXT).
+    # LIKE wildcards typed by the user are escaped, so "%" and "_" match literally.
+    def lato_index_search_condition(collection, columns, search)
+      escape_character = '!'
+      pattern = "%#{ActiveRecord::Base.sanitize_sql_like(search.downcase.strip, escape_character)}%"
+      cast_type = collection.connection.adapter_name.match?(/mysql|trilogy/i) ? 'CHAR' : 'TEXT'
+      table = collection.arel_table
+
+      columns.map do |column|
+        attribute = table[column]
+        value = if %i[string text].include?(collection.column_for_attribute(column).type)
+          Arel::Nodes::NamedFunction.new('LOWER', [attribute])
+        else
+          Arel::Nodes::NamedFunction.new('CAST', [attribute.as(Arel.sql(cast_type))])
+        end
+        value.matches(pattern, escape_character)
+      end.reduce(:or)
+    end
+
     def parse_lato_index_sort_by(sort_by, sortable_columns)
       sort_by_column, sort_by_order = sort_by.to_s.split("|", 2)
       sort_by_column = sort_by_column.to_s

data/app/controllers/concerns/lato/sessionable.rb

@@ -32,18 +32,46 @@ module Lato
 
     def limit_requests(limit = 10, time_window = 10.minutes)
       cache_key = "Lato::Sessionable/limit_requests/#{controller_name}/#{action_name}/#{request.remote_ip}"
-      attempts = Rails.cache.read(cache_key) || 0
-      
-      attempts += 1
-      Rails.cache.write(cache_key, attempts, expires_in: time_window)
-      return true unless attempts >= limit
+      # increment is atomic on shared stores, so parallel requests can not slip past the limit.
+      attempts = Rails.cache.increment(cache_key, 1, expires_in: time_window).to_i
+      return true if attempts <= limit
 
+      respond_to_too_many_requests(time_window)
+      false
+    end
+
+    # Per-account throttle on failed attempts: complements the per-IP limit against distributed brute force.
+    ACCOUNT_LIMIT_ATTEMPTS = 10
+    ACCOUNT_LIMIT_TIME_WINDOW = 15.minutes
+
+    def account_limit_reached?(identifier)
+      return false if identifier.blank?
+
+      reached = Rails.cache.read(account_limit_cache_key(identifier), raw: true).to_i >= ACCOUNT_LIMIT_ATTEMPTS
+      respond_to_too_many_requests(ACCOUNT_LIMIT_TIME_WINDOW) if reached
+      reached
+    end
+
+    def account_limit_track_failure(identifier)
+      return if identifier.blank?
+
+      Rails.cache.increment(account_limit_cache_key(identifier), 1, expires_in: ACCOUNT_LIMIT_TIME_WINDOW)
+    end
+
+    def account_limit_reset(identifier)
+      Rails.cache.delete(account_limit_cache_key(identifier)) if identifier.present?
+    end
+
+    def account_limit_cache_key(identifier)
+      "Lato::Sessionable/account_limit/#{Digest::SHA256.hexdigest(identifier.to_s.downcase.strip)}"
+    end
+
+    def respond_to_too_many_requests(time_window)
+      message = I18n.t('lato.too_many_requests', minutes: (time_window.to_i / 60.0).ceil)
       respond_to do |format|
-        format.html { render plain: "Too many requests, please wait #{time_window.to_i / 60} minutes to retry.", status: :too_many_requests }
-        format.json { render json: {}, status: :too_many_requests }
+        format.html { render plain: message, status: :too_many_requests }
+        format.json { render json: { error: message }, status: :too_many_requests }
       end
-
-      false
     end
 
     def session_create(user_id)
@@ -65,7 +93,8 @@ module Lato
         value: value,
         expires: @session.expires_at,
         httponly: true,
-        secure: request.ssl?
+        secure: request.ssl?,
+        same_site: :lax
       }
       true
     end

data/app/controllers/lato/account_controller.rb

@@ -37,8 +37,9 @@ module Lato
         success = user.remove_authenticator_secret
       elsif params.dig(:user, :authenticator_command) == "confirm"
         pending = session.delete(:pending_authenticator_secret)
-        success = pending.present? && ROTP::TOTP.new(pending).verify(params.dig(:user, :authenticator_code).to_s)
-        success = user.update(authenticator_secret: pending) if success
+        used_at = pending.present? && ROTP::TOTP.new(pending).verify(params.dig(:user, :authenticator_code).to_s, drift_behind: 15)
+        # Store the enrollment code timestamp so the same code can not be replayed for the first login.
+        success = used_at ? user.update(authenticator_secret: pending, authenticator_last_used_at: Time.at(used_at)) : false
         user.errors.add(:base, :authenticator_code_invalid) unless success
         @session.clear_security_continuation
       else
@@ -126,12 +127,10 @@ module Lato
         end
       elsif session[:web3_nonce]
         respond_to do |format|
-          if @session.user.add_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(web3_nonce: session[:web3_nonce]))
-            session[:web3_nonce] = nil
+          if @session.user.add_web3_connection(params.require(:user).permit(:web3_address, :web3_signed_nonce).merge(web3_nonce: web3_message_consume))
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else
-            session[:web3_nonce] = nil
             format.html { render :index, status: :unprocessable_entity }
             format.json { render json: @session.user.errors, status: :unprocessable_entity }
           end
@@ -139,7 +138,7 @@ module Lato
       else
         respond_to do |format|
           grant_security_continuation
-          if session[:web3_nonce] = SecureRandom.hex(32)
+          if web3_message_generate('connect your wallet')
             format.html { redirect_to lato.account_path }
             format.json { render json: @session.user }
           else
@@ -222,7 +221,10 @@ module Lato
         session.delete(:webauthn_registration_challenge)
         session.delete(:webauthn_registration_options)
       end
-      session.delete(:web3_nonce) unless action == "update_web3_action"
+      return if action == "update_web3_action"
+
+      session.delete(:web3_nonce)
+      session.delete(:web3_nonce_expires_at)
     end
 
     def reauthenticate_sensitive_action
@@ -254,7 +256,7 @@ module Lato
       end
       return if password_valid && factor_valid
 
-      user.errors.add(:base, "Confirm your current password and enabled second factor to continue.")
+      user.errors.add(:base, I18n.t('lato.security_confirmation_required'))
       respond_to do |format|
         format.html { render :index, status: :unprocessable_entity }
         format.json { render json: user.errors, status: :unprocessable_entity }

data/app/controllers/lato/application_controller.rb

@@ -46,11 +46,35 @@ module Lato
 
     def respond_to_redirect_same_page(notice = nil)
       respond_to do |format|
-        format.html { redirect_to request.referer, notice: notice }
+        # Never follow a Referer pointing to another host (open redirect).
+        format.html { redirect_back_or_to lato.root_path, allow_other_host: false, notice: notice }
         format.json { render json: {} }
       end
     end
 
+    # Web3 challenge: the signed text binds the signature to this host, a purpose and a short lifetime,
+    # so a signature collected by another site can not be replayed here.
+    WEB3_MESSAGE_LIFETIME = 5.minutes
+
+    def web3_message_generate(purpose)
+      session[:web3_nonce] = [
+        "#{request.host} wants you to #{purpose} with your Ethereum account.",
+        "",
+        "URI: #{request.base_url}",
+        "Nonce: #{SecureRandom.hex(16)}",
+        "Issued At: #{Time.current.utc.iso8601}"
+      ].join("\n")
+      session[:web3_nonce_expires_at] = WEB3_MESSAGE_LIFETIME.from_now.to_i
+      session[:web3_nonce]
+    end
+
+    # Single use: the message is removed from the session whatever the outcome.
+    def web3_message_consume
+      message = session.delete(:web3_nonce)
+      expires_at = session.delete(:web3_nonce_expires_at).to_i
+      message if message.present? && Time.current.to_i <= expires_at
+    end
+
     def respond_to_with_offline
       hide_sidebar
       respond_to do |format|