Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
The shared form reader converts Content-Length with int() and reads that many bytes without a general limit or socket deadline. Only the exact enabled portal handoff route performs a size check first. The CSRF-refusal branch also reads the complete body before returning 403.
When portal handoff is enabled, Caddy exposes /USER/auth/* to the daemon without Basic auth. Other POST paths under that prefix fall through to the general reader before route rejection. Missing Origin/Sec-Fetch-Site is accepted for non-browser clients. Thus the route-specific token cap is not a cap on the full unauthenticated route family.
Evidence: form reader and POST dispatch, public auth route, and threaded server. This is a source/configuration finding; no large-body or connection-flood test was performed against a real service.
Recommended change:
- Validate Content-Length once and reject malformed, negative, or oversized values before allocation/read.
- Reject unknown unauthenticated auth paths before reading their bodies.
- Bound draining, request read time, and concurrent public authentication work.
- Make proxy and application limits consistent, including the CSRF-error path.
Acceptance:
- With portal enabled, every unauthenticated auth route rejects an excessive declared length without reading the declared body.
- Malformed/negative lengths produce a controlled 4xx.
- A slow body cannot hold a worker indefinitely, and normal forms/sign-in still work.
- Exercise the actual Caddy-to-daemon route using a bounded synthetic test.
P2 for the current optional portal scope. Resolve before declaring portal authentication release-qualified. This implementation is in agent-box, not local-channels.
Audit baseline: 0cc18b8, verified against current master on 2026-09-10.
The shared form reader converts Content-Length with int() and reads that many bytes without a general limit or socket deadline. Only the exact enabled portal handoff route performs a size check first. The CSRF-refusal branch also reads the complete body before returning 403.
When portal handoff is enabled, Caddy exposes /USER/auth/* to the daemon without Basic auth. Other POST paths under that prefix fall through to the general reader before route rejection. Missing Origin/Sec-Fetch-Site is accepted for non-browser clients. Thus the route-specific token cap is not a cap on the full unauthenticated route family.
Evidence: form reader and POST dispatch, public auth route, and threaded server. This is a source/configuration finding; no large-body or connection-flood test was performed against a real service.
Recommended change:
Acceptance:
P2 for the current optional portal scope. Resolve before declaring portal authentication release-qualified. This implementation is in agent-box, not local-channels.