laststance / laststance/gitbox
Server-side attempt cap bypassed when sessionStorage unavailable
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 2
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 2
Description
Summary
sessionStorage-based attempt counter can be bypassed if storage is unavailable.
Source
P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).
Details
If Safari private mode / quota exceeded, the client always sends attempt=1; the server cap (> 1) never trips, allowing infinite refresh loops.
Fix
Add a server-side short-lived nonce/cookie counter, OR send attempt=2 after first in-memory attempt when storage fails.
Acceptance
- Server-side enforced cap regardless of client sessionStorage state
- Tests cover unavailable-storage scenario
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading PR #176 and tracing the server-side attempt cap and the client refresh path that uses sessionStorage. Reproduce the unavailable-storage case, then add coverage for it. Done means the server enforces the cap even when sessionStorage cannot persist attempts, with the acceptance tests passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github, typescript
- Domain
- authentication, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100