timescale.info#219 · The password confirms security changes; errors show beside their form
- timeline-app
- pull request
- security
Creating a second API key a few minutes after signing in failed. The server answered 403 "Sign out and sign in again before changing security settings.", and the account page showed it far below the key form, under "Linked sign-in methods". So it looked as if nothing happened. The form also asked for the current password even though the password didn't get you past the check. ### The password confirms the change `AccountSecurity.fresh`, the check behind every security change, used to require a session that began within five minutes **and** the current password (plus a code with two-factor authentication). Now: - With a password, the password confirms the change at any time in a live session, plus a fresh code when two-factor authentication is on. This is like GitHub's sudo mode. - An account with no password (signed up through a provider) has nothing to re-enter. It still needs a sign-in within five minutes. - Unchanged: the session must still be live (not revoked, expired or idle) and must have completed two-factor authentication. The check covers API keys, password, email and two-factor changes, unlinking providers, deleting the account, administration changes and moderation decisions. Approving a desktop connection and linking a provider keep their own five-minute rule, because they don't ask for a password. The messages now say what to do: "Your sign-in is more than five minutes old. Sign out and sign in again to confirm it is you." / "This session has ended. Sign in again to change security settings." ### Errors beside the form - **Profile and account access:** each failure now shows inside the form or list that caused it: avatar, sensitive content, API keys (creating, revoking, removing), unlinking, deleting. - **The account's security form:** its message and errors show right after the form instead of at the very bottom of the page. Signed-out pages keep them under the sign-in forms. The page notes, the admin panel's confirmation note, `docs/authentication.md`, `docs/administration.md`, `docs/moderation.md` and the OpenAPI descriptions now describe the new rule. ### Tests - `test/account-security-postgres.mjs` now covers this. With the session aged to an hour, a wrong password gets 401, the right one creates keys twice, and a password-less account gets the 403 until its sign-in is recent. - With the old server code the new test fails with the reported error. - The administration, moderation, deletion, admin-reset and challenge Postgres tests pass locally, and so do `npm test` (299) and the typecheck. - The signed-in account page has no browser test (it needs Postgres behind Next), so I haven't seen the error placement in a browser. CI's Next build checks that it compiles.
Sources
Open #219 · The password confirms security changes; errors show beside their form in the timeline