kubus/scout
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add API token browser sign-in with credential-bound sessions #15

Merged
kubus merged 1 commit from security/internet-deploy-hardening into main 2026-09-30 15:35:04 +00:00
Conversation 0 Commits 1 Files changed 8 +129 -47
kubus commented 2026-09-30 15:34:55 +00:00
Owner
Copy link

Summary

  • API tokens can now authenticate browser sign-in, not just bearer token requests; the dashboard accepts either password or any configured token
  • Browser sessions are now bound to their credential: changing the password revokes password sessions, and removing a token from SCOUT_API_TOKENS revokes that token's sessions
  • Sessions signed in with an API token are keyed by token, so they stay valid across restarts (unlike earlier token-only proposals)
  • Add node scripts/generate-api-token.mjs [count] to generate 32-byte base64url tokens; replaces manual openssl rand -base64 36
  • Token sign-in attempts count toward the same per-IP rate limit as password attempts (10/15min)
  • Documentation updated: README describes token authentication, .env.example and login UI reflect the unified sign-in path

Testing

  • npm run typecheck && npm test — unit tests verify token generation, credential binding, session revocation, and rate limit counts
  • Password sign-in continues to work as before
  • API token sign-in works in both bearer requests (Authorization: Bearer <token>) and browser login
  • Removing a token from SCOUT_API_TOKENS revokes its browser sessions after the next purge or restart
  • Token-only setup (no password) allows dashboard access without SCOUT_PASSWORD_HASH
## Summary - API tokens can now authenticate browser sign-in, not just bearer token requests; the dashboard accepts either password or any configured token - Browser sessions are now bound to their credential: changing the password revokes password sessions, and removing a token from `SCOUT_API_TOKENS` revokes that token's sessions - Sessions signed in with an API token are keyed by token, so they stay valid across restarts (unlike earlier token-only proposals) - Add `node scripts/generate-api-token.mjs [count]` to generate 32-byte base64url tokens; replaces manual `openssl rand -base64 36` - Token sign-in attempts count toward the same per-IP rate limit as password attempts (10/15min) - Documentation updated: README describes token authentication, `.env.example` and login UI reflect the unified sign-in path ## Testing - `npm run typecheck && npm test` — unit tests verify token generation, credential binding, session revocation, and rate limit counts - Password sign-in continues to work as before - API token sign-in works in both bearer requests (`Authorization: Bearer <token>`) and browser login - Removing a token from `SCOUT_API_TOKENS` revokes its browser sessions after the next purge or restart - Token-only setup (no password) allows dashboard access without `SCOUT_PASSWORD_HASH`
Add API token browser sign-in with credential-bound sessions
Some checks failed
ci / verify (pull_request) Has been cancelled
Details
dc432ae7e3 
- Sessions now bound to the credential (password or token) that signed them in
- Removing a token from SCOUT_API_TOKENS revokes its browser sessions
- Token and password sign-ins share the same 10/15min rate limit
- Added generate-api-token.mjs script for secure token generation
kubus merged commit 8835b01938 into main 2026-09-30 15:35:04 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kubus/scout!15
No description provided.