standard_id 0.26.4 → 0.28.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 80484283cdfb54ecc2ead53d1498b5cd9ee88813e755b972db2e2d15561362f7
-  data.tar.gz: 9f9aaea4b18b29a61c3d3e70d7be8f1c2016455b3866181b9bea0cd272617405
+  metadata.gz: c3aa81db933d1f506926c8c400e2bc57f60a7b29529f7bfa514e71b68fe028c1
+  data.tar.gz: 47a3be048ef63b02ee3819354dae0e4af75cb21a88d740e5b72e754c55471a2a
 SHA512:
-  metadata.gz: 203398f53eacaf60b272dbaf84794c71d2a975fbd1f49669d37dc3375de6fa7d24f00b36f352a9bb09909e82e1947f4513082b397b61a664e22f0180aa34f665
-  data.tar.gz: 737d854a5784cf508954f343482e0476e2f5ad7a40322a26d7e0360c6910af6333a954bab7e9f490fb66ffc77ee15946dff62e2afd4a5d67387c9aca60e04cf4
+  metadata.gz: e4b6618506a9428d7a426ad4d095bd95fd2aa9c3f7b58e8727f20e8300d8dc3c6f622da1e07829961474c392d35a292775f4596b36e39c0961f66a28cca2db7a
+  data.tar.gz: 585a4b2d8c65e4d9de10eb8466d99c9323ea6279459edf21fe72705f829688cded440133faaa50317a01bcf4d2544ecf48b01749527287be73cc042eb833fe6a

data/app/controllers/standard_id/web/reset_password/start_controller.rb

@@ -7,6 +7,23 @@ module StandardId
 
         layout "public"
 
+        # Rate limit reset-request generation by IP (10 per hour). The endpoint
+        # emails a reset token, so without a limit it's an email-flooding vector.
+        rate_limit to: StandardId.config.rate_limits.password_reset_start_per_ip,
+                   within: 1.hour,
+                   name: "reset-password-ip",
+                   only: :create,
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
+        # Rate limit reset requests by email target (3 per 15 minutes) to blunt
+        # account-enumeration probing of individual addresses.
+        rate_limit to: StandardId.config.rate_limits.password_reset_start_per_target,
+                   within: 15.minutes,
+                   by: -> { "reset-password:#{params[:email].to_s.strip.downcase}" },
+                   name: "reset-password-target",
+                   only: :create,
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         skip_before_action :require_browser_session!, only: [:show, :create]
 
         def show

data/app/controllers/standard_id/web/signup_controller.rb

@@ -9,6 +9,13 @@ module StandardId
 
       layout "public"
 
+      # Throttle account-creation spam by IP (10 per hour).
+      rate_limit to: StandardId.config.rate_limits.signup_per_ip,
+                 within: 1.hour,
+                 name: "signup-ip",
+                 only: :create,
+                 store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
       skip_before_action :require_browser_session!, only: [:show, :create]
 
       before_action :redirect_if_authenticated, only: [:show]

data/app/controllers/standard_id/web/verify_email/confirm_controller.rb

@@ -2,6 +2,15 @@ module StandardId
   module Web
     module VerifyEmail
       class ConfirmController < BaseController
+        # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
+        # verify). The per-challenge attempt cap alone doesn't stop distributed
+        # guessing across many challenges; both show and update probe a code.
+        rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
+                   within: 15.minutes,
+                   name: "verify-email-confirm-ip",
+                   only: [:show, :update],
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         before_action :prepare_code_challenge
 
         def show

data/app/controllers/standard_id/web/verify_phone/confirm_controller.rb

@@ -2,6 +2,15 @@ module StandardId
   module Web
     module VerifyPhone
       class ConfirmController < BaseController
+        # Per-IP limit on code confirmation (20 per 15 minutes, shared with OTP
+        # verify). The per-challenge attempt cap alone doesn't stop distributed
+        # guessing across many challenges; both show and update probe a code.
+        rate_limit to: StandardId.config.rate_limits.otp_verify_per_ip,
+                   within: 15.minutes,
+                   name: "verify-phone-confirm-ip",
+                   only: [:show, :update],
+                   store: StandardId::RateLimitHandling::RATE_LIMIT_STORE
+
         before_action :prepare_code_challenge
 
         def show

data/app/models/standard_id/client_application.rb

@@ -34,6 +34,11 @@ module StandardId
     scope :public_clients, -> { where(client_type: "public") }
     scope :for_owner, ->(owner) { where(owner: owner) }
 
+    # Loopback interface hosts per RFC 8252 §7.3 (native apps). "localhost" is
+    # included for compatibility but RFC 8252 §8.3 recommends clients use
+    # 127.0.0.1/::1 instead, since "localhost" can be remapped by the OS.
+    LOOPBACK_HOSTS = %w[127.0.0.1 ::1 localhost].freeze
+
     # Callbacks
     before_create :generate_client_id
     before_update :set_deactivated_at, if: :will_save_change_to_active?
@@ -99,6 +104,12 @@ module StandardId
     # (or, worse, a different path segment like /cb/evil).
     #
     # Subdomain wildcards are NOT supported — host must match exactly.
+    #
+    # Exception — loopback redirects for native apps (RFC 8252 §7.3): when this
+    # client is public + PKCE-required and BOTH the registered and requested
+    # URIs are http loopback URIs, the port is ignored (native apps bind an
+    # ephemeral port on a local listener at authorization time, so it cannot be
+    # known at registration). See #loopback_redirect_uri? below.
     def valid_redirect_uri?(uri)
       requested = self.class.parse_redirect_uri(uri)
       return false unless requested
@@ -107,6 +118,23 @@ module StandardId
         registered = self.class.parse_redirect_uri(registered_uri)
         next false unless registered
 
+        # RFC 8252 §7.3: for loopback interface redirects, "the authorization
+        # server MUST allow any port to be specified at the time of the request".
+        # Only host + path are compared; scheme is already pinned to "http" by
+        # the loopback predicate. Host equality is still required, so a client
+        # registered with 127.0.0.1 does not match localhost (or vice versa) —
+        # per §8.3, "localhost" is less trustworthy than the literal loopback
+        # IPs because the OS can remap it. This relaxation is gated to public
+        # PKCE clients: the redirect lands on an ephemeral listener on the
+        # user's own machine and PKCE binds the code to the initiating client,
+        # whereas confidential clients have stable callback URLs and keep
+        # strict port matching.
+        if public? && require_pkce? &&
+            self.class.loopback_redirect_uri?(registered) &&
+            self.class.loopback_redirect_uri?(requested)
+          next registered.host == requested.host && registered.path == requested.path
+        end
+
         registered.scheme == requested.scheme &&
           registered.host == requested.host &&
           registered.port == requested.port &&
@@ -114,6 +142,17 @@ module StandardId
       end
     end
 
+    # True when the parsed URI is an http URI targeting a loopback interface
+    # literal (RFC 8252 §7.3). IPv6 loopback hosts are normalized: URI.parse
+    # yields "[::1]" on some Ruby versions and "::1" on others, so surrounding
+    # brackets are stripped before comparison.
+    def self.loopback_redirect_uri?(parsed_uri)
+      return false unless parsed_uri.scheme == "http"
+
+      host = parsed_uri.host.to_s.delete_prefix("[").delete_suffix("]")
+      LOOPBACK_HOSTS.include?(host)
+    end
+
     # Parse a redirect URI string into a URI object suitable for comparison.
     # Returns nil for unparseable, relative, or scheme-less URIs.
     def self.parse_redirect_uri(value)

data/lib/generators/standard_id/install/templates/standard_id.rb

@@ -153,7 +153,10 @@ StandardId.configure do |c|
   # for backwards compatibility; new installs should set the newer key.
   # c.passwordless.max_attempts = 3
 
-  # Default: 30 — seconds before a new challenge can be requested.
+  # Default: 30 — OTP-resend cooldown: minimum seconds before the same target
+  # can request another code. Enforced in the passwordless start path; a resend
+  # inside the window is rejected (the already-sent code stays valid). Set to 0
+  # to disable the cooldown.
   # c.passwordless.retry_delay = 30
 
   # Custom username validator; return nil/false to accept, or an error message

data/lib/standard_id/config/schema.rb

@@ -352,6 +352,15 @@ StandardId::ConfigSchema.define do
     field :verification_start_per_target, type: :integer, default: 3 # per 15 minutes
     field :verification_start_per_ip, type: :integer, default: 10    # per hour
 
+    # Password-reset request. The start endpoint emails a reset token, so an
+    # unthrottled endpoint is an email-flooding + account-enumeration vector.
+    # Mirrors the verification_start shape (per-IP hourly + per-target 15-min).
+    field :password_reset_start_per_ip, type: :integer, default: 10      # per hour
+    field :password_reset_start_per_target, type: :integer, default: 3   # per 15 minutes
+
+    # Password signup — throttle account-creation spam by IP.
+    field :signup_per_ip, type: :integer, default: 10                    # per hour
+
     # API equivalents
     field :api_passwordless_start_per_ip, type: :integer, default: 10    # per hour
     field :api_passwordless_start_per_target, type: :integer, default: 5 # per 15 minutes

data/lib/standard_id/passwordless/base_strategy.rb

@@ -23,6 +23,7 @@ module StandardId
 
         validate_username!(username)
         run_username_validator!(username)
+        enforce_retry_delay!(username)
         emit_code_requested(username)
         challenge = create_challenge!(
           username,
@@ -43,6 +44,29 @@ module StandardId
 
       protected
 
+      # Reject a resend that arrives within passwordless.retry_delay seconds of
+      # the most recent still-active code for this target. A soft cooldown that
+      # complements the coarser per-target rate limits: it does not consume the
+      # active challenge, so the code already sent remains usable. Raises
+      # InvalidRequestError (rescued by the web login + API OAuth error handlers).
+      def enforce_retry_delay!(username)
+        delay = StandardId::Passwordless.retry_delay
+        return if delay <= 0
+
+        last = StandardId::CodeChallenge.active
+          .where(realm: @realm, channel: connection_type, target: username)
+          .order(created_at: :desc)
+          .first
+        return if last.nil?
+
+        elapsed = Time.current - last.created_at
+        return if elapsed >= delay
+
+        wait = (delay - elapsed).ceil
+        raise StandardId::InvalidRequestError,
+          "Please wait #{wait} #{'second'.pluralize(wait)} before requesting another code"
+      end
+
       def create_challenge!(username, code_length: nil, expires_in: nil, metadata: {})
         ActiveRecord::Base.transaction do
           invalidate_active_challenges!(username)

data/lib/standard_id/passwordless.rb

@@ -83,6 +83,14 @@ module StandardId
         legacy = StandardId.config.passwordless.max_attempts.to_i
         legacy.positive? ? legacy : 5
       end
+
+      # Minimum seconds that must elapse between successive code requests for
+      # the same target (the OTP-resend cooldown). Reads passwordless.retry_delay;
+      # 0 or negative disables the cooldown. Enforced in the passwordless strategy
+      # start path (see BaseStrategy#enforce_retry_delay!).
+      def retry_delay
+        StandardId.config.passwordless.retry_delay.to_i
+      end
     end
   end
 end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.26.4"
+  VERSION = "0.28.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.26.4
+  version: 0.28.0
 platform: ruby
 authors:
 - Jaryl Sim