laststance / laststance/gitbox
30-day provider token cookie TTL — risk re-confirm
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 2
- Avg merge
- 6h 9m
- Merged PRs (30d)
- 2
Description
Summary
30-day provider token cookie TTL materially expands the replay window vs. the previous 8h.
Source
P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).
Details
Cookie flags are good (httpOnly, secure in prod, SameSite=Lax); scope is read:user user:email repo (write access included).
Risk
A 30-day window enables longer replay if the cookie is exfiltrated.
Action items
- Re-confirm 30d TTL is acceptable for replay risk
- If write access isn't required for the current product surface, narrow OAuth scopes from
repotopublic_repoorread:org
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with PR #176 and trace the provider token cookie and OAuth scope implementation. Confirm whether the current product surface needs write access and whether the 30-day replay exposure is acceptable. Done means the decision is recorded, with TTL or scopes changed if required and the resulting security behavior verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100