fix(security): refuse plaintext bearer-token transmission (Phase C, C1)#215
Merged
Conversation
…oordinators
Monster Phase C, item C1 (audit S1, High). Sykli.Coordinator.Client now refuses
to send the Team Mode bearer token over plaintext HTTP to a non-loopback host
(returns {:error, {:insecure_transport, url}} + logs an error) instead of
leaking it on the wire. HTTPS and loopback are unaffected; SYKLI_COORDINATOR_INSECURE=1
is an explicit opt-in with a loud warning. All token-bearing paths (work/run/gate
clients, daemon join) route through this client. New Sykli.HTTP.check_token_transport/1
holds the shared decision.
Verification: mix format/credo/test (1752, 0 failures), escript.build,
black-box team-sync + COORD cases pass (loopback allowed).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Monster Phase C — item C1 (audit S1, High) from
docs/audit-2026-05-22.md.The Team Mode bearer token was sent with no scheme check:
Sykli.HTTP.ssl_opts/1returns[]for non-HTTPS, andCoordinator.ClientsentAuthorization: Bearer <token>regardless — so ahttp://coordinator leaked the token in cleartext to any on-path observer (an in-scope adversary perdocs/team-mode-security.md).Fix
Sykli.HTTP.check_token_transport/1::okfor HTTPS, loopback hosts, or an explicitSYKLI_COORDINATOR_INSECURE=1opt-in; otherwise{:error, :insecure_transport}.Coordinator.Client.request_json/5refuses (returns{:error, {:insecure_transport, url}}+ logs an error) before sending; warns loudly when the opt-in carries a plaintext send. All token-bearing paths — work/run/gate clients and daemon join — route through this client, so one guard covers them.Scope note
Phase C is split for focused review. This PR is C1 only. Remaining (with decisions locked):
webhook_url(connect_timeoutalready present)Verification
mix format/mix credo(clean) /mix test(1752, 0 failures, +6 HTTP tests) /mix escript.build; black-box team-sync + COORD cases pass (loopback allowed).🤖 Generated with Claude Code