Late feature denial probe reuses deleted member sessions #1421

Open
opened 2026-10-07 23:07:27 +00:00 by kayg · 0 comments
Owner

Found in the one merge34 / #1403 release-server round. Head d395b6e25d; runtime ef0aa12b1.

attack2.py runs security-origin-licence after deletion. Deletion removes the original B/C/D Users and asserts their sessions are revoked. security-origin-licence then reuses B/C/D bearer variables and expects authenticated non-Admin denial 403 for two absent feature keys. All six requests return:

401 {"code":"unauthenticated","message":"Authentication required"}

The source explicitly selects 403 for every non-null bearer, even if its User was deleted earlier. No request succeeded; feature values and Licence status remained unchanged. Cookie Origin refusals passed. The earlier live XUser matrix had zero denial failures.

Non-blocking probe-order/fixture defect. It does not establish an authorization hole, but this late phase does not prove authenticated non-Admin 403 denial. Keep the existing expectation and arrange a live fixture before running it (or run this phase before deletion). Add a regression that the phase uses non-deleted Users. Do not change its expected status to 401 simply to pass.

Found in the one merge34 / #1403 release-server round. Head d395b6e25da20d8c67b8b9fc1a593b813939c8a7; runtime ef0aa12b1. attack2.py runs security-origin-licence after deletion. Deletion removes the original B/C/D Users and asserts their sessions are revoked. security-origin-licence then reuses B/C/D bearer variables and expects authenticated non-Admin denial 403 for two absent feature keys. All six requests return: ``` 401 {"code":"unauthenticated","message":"Authentication required"} ``` The source explicitly selects 403 for every non-null bearer, even if its User was deleted earlier. No request succeeded; feature values and Licence status remained unchanged. Cookie Origin refusals passed. The earlier live XUser matrix had zero denial failures. Non-blocking probe-order/fixture defect. It does not establish an authorization hole, but this late phase does not prove authenticated non-Admin 403 denial. Keep the existing expectation and arrange a live fixture before running it (or run this phase before deletion). Add a regression that the phase uses non-deleted Users. Do not change its expected status to 401 simply to pass.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1421
No description provided.