Skip to content

History / Security Model

Revisions

  • Document AllowPrivateNetworkAddresses and route the blocked-address failure to it [#1280] The setting shipped fully wired - model, admin form, insecure-toggle audit, config export/import, and the transport that honours it - and nothing outside the source described it. An administrator whose identity provider lives on their own network met "The outbound host resolves only to blocked addresses" with no documented setting to reach for, which is the state that produces a workaround instead of the opt-in. Adds a section to the Options Reference stating what the toggle widens, that it is per provider and off by default including across an upgrade, that enabling it is recorded as a downgrade, and what it explicitly does not relax. The Security Model's outbound-fetch section said every fetch is pinned to public addresses, which stopped being the whole truth when the second outbound tier landed; it now carries the exception, its bounds, and the link, so the failure text routes to the setting.

    @iderex iderex committed Aug 12, 2026
  • Replace the typographic dashes on every page 612 dashes across 22 of the 30 pages. No page ends a line with a space afterwards, and 566 dashes that would have started a Markdown list are escaped so the list does not appear. A wiki has no pull request and no gate, so the counts before and after are the evidence: the run is recorded in iderex/operations#861. Part of the fleet-wide pass in iderex/operations#860. Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>

    @iderex iderex committed Aug 9, 2026
  • Fix Home + de-link the pages that moved to internal docs The five process pages that moved to the local docs/ (Roadmap, Threat-Model, Delivery-Metrics, Security-and-Maturity-Self-Assessment, Native-OIDC-Coexistence) are wiki stubs now, but Home and several public pages still linked them. Clean Home's page list, de-link the internal pages from Installation, Migrating-from-9p4, Releasing, and Security-Model (keeping the surrounding text and the maturity-ladder wording inline), point Home at the public Comparison page for the native-OIDC stance, and fix Home's install wording (adding the plugin's own repository, not the built-in catalog). Refs #822 #987

    @iderex iderex committed Jul 24, 2026
  • Consolidate the wiki: canonical Coding Standards, merged Architecture, split Provider Setup Restructure the wiki into one coherent, audience-grouped set with a single home for each fact. - New Coding-Standards page: the one canonical statement of the architecture, comment/documentation (#864), and object-oriented rules; the repo's CLAUDE.md and CONTRIBUTING.md now point here instead of restating them. - Merged the two stale, mutually-overlapping Architecture pages into one, re-based on the current module-DAG reality (the old pages claimed the module split was "not pursued" and that no IPluginServiceRegistrator existed — both were wrong and contradicted docs/ARCHITECTURE.md). Cites modules and types, never file:line, so it cannot drift on a move again. - Split Provider-Setup (1172 lines, ~73% not provider-specific) into Provider Setup (recipes) + a new Hardening & Options Reference; folded the security- control narrative into the Security Model. Every moved section left a pointer. - Merged Release-Policy + Release-QA-Checklist into Releasing (renamed the per-release ladder to "release promotion ladder" to end the Beta-rung name collision); merged OpenSSF-Best-Practices + Maturity-Map into Security & Maturity Self-Assessment. Old slugs kept as redirect stubs. - Rebuilt the sidebar into four audience groups (Getting started / How it works / Security / Standards & process). Fixed the broken anchors, corrected the beta publish-trigger to the daily scheduler (it is not "every merge"), de-referenced the design records to module/type names, and trimmed Home's README duplication.

    @iderex iderex committed Jul 20, 2026
  • Record the minimum signing-key strength floor as Met (#733)

    @iderex iderex committed Jul 20, 2026
  • Reflect the OIDC SSRF parity landing (#755) in the security docs The Security-Conformance V12 row flips from Met(avatar)/Partial(OIDC) to Met (the shared hardened transport in Api/Net/SsoHttp now guards discovery/JWKS/token/userinfo), and the #755 accepted-residual is removed; the Security-Model SSRF section is broadened from avatar-only to all outbound fetches with the shared connect-time guard.

    @iderex iderex committed Jul 20, 2026
  • Document SSO-only login: runbook, security summary, lockout recovery The mode shipped (#665) but the wiki still called it not implemented, and the settings page points at a Provider Setup runbook that did not exist. - Provider Setup: full operator runbook (enforcement semantics, break-glass guard, the four elevation-gated endpoints, server-managed state, recovery) - Security Model: enforcement-property summary and the audited transitions - Troubleshooting: locked-out recovery entry (break-glass, config-XML edit) - SSO-Only Login Design: status corrected to implemented, kept as the record - Home: feature listed under what it does today

    @iderex iderex committed Jul 19, 2026
  • Migrate design, process, and provider docs from the repo into the wiki Add wiki pages for the per-provider setup guides, the delivery-pipeline threat model, the release/rollback/review-gate/QA process docs, the DORA delivery metrics, the OpenSSF best-practices assessment, the single-logout and SSO-only-login design notes, and an architecture-internals code map. Retarget every internal link: cross-doc references now point at wiki pages, references to files that stay in the repo point at full github blob URLs, and provider screenshots point at raw.githubusercontent URLs. Add a grouped navigation to Home (user docs / architecture & security / process & release / design records), cross-link Login-Flow and Architecture with the new Architecture-Internals map, and cross-link Security-Model with Threat-Model.

    @iderex iderex committed Jul 19, 2026
  • Document issuer-binding, secrets-at-rest, and the legacy-link upgrade path Mirror the current providers.md security posture onto the wiki: - Security-Model: issuer-bound OpenID links (repointing protection), secrets encrypted at rest (ssoenc envelope + downgrade note), and the admin-account exemption for the legacy username-keyed link migration. - Migrating-from-9p4: issuer-binding behavior and the encrypted-secret rollback caveat. - Troubleshooting: the post-upgrade gated legacy-link case (403 / fresh account). Closes #371.

    @iderex iderex committed Jul 18, 2026
  • Document the login browser binding, SAML response-binding options, and per-client in-flight capacity Merged since the last wiki pass: the SAML browser-binding cookie (#415) alongside the existing OpenID one, and the per-client share of the in-flight state stores (#327). The Security Model page now covers both binding cookies, the opt-in ValidateRecipient/ValidateInResponseTo checks, and the capacity model; Troubleshooting gains the matching failure modes (HTTP-only deployments, cross-browser callbacks, lost InResponseTo correlation, IdP-initiated logins with ValidateInResponseTo on).

    @iderex iderex committed Jul 17, 2026
  • Document provider-disable semantics on the grant paths

    @iderex iderex committed Jul 16, 2026
  • Gate the legacy-link migration note behind AllowExistingAccountLink Mirrors the #354 fix into the wiki: the Security Model page gains an upgrade note (the legacy username-keyed migration now honors the AllowExistingAccountLink opt-in, with break-glass and the takeover-window caveat), and the 9p4 migration page's now-false 'migrates automatically, no admin action' line is corrected to point at the flag and the runbook.

    @shippingToken shippingToken committed Jul 15, 2026
  • Document the auth-page CSP and the rate-limiter keying/notice; drop the stale pre-alpha label The Security Model page did not mention the nonce-based Content-Security-Policy the auth page has carried since the response-hardening work, even though the Login Flow page already points at the Response hardening section for it. Describe the policy and what it denies. The rate-limiting section now also covers two behaviors that landed after the last wiki pass: IPv4-in-IPv6 transition sources (NAT64 well-known prefix, 6to4, IPv4-compatible) are keyed on their embedded IPv4 rather than the shared /64, and throttling engagement is summarized in a bounded log notice (one line per minute, count only) so an operator can spot sustained abuse or a pooled-proxy misconfiguration. The migration page still called the project pre-alpha; the maturity ladder names this stage In-Development, so align the warning with the Roadmap wording.

    @iderex iderex committed Jul 14, 2026
  • Document the PKCE downgrade check, SAML size cap, and state-store bound

    @iderex iderex committed Jul 13, 2026
  • Document the hardening merged since the last wiki pass Security Model: RFC 9207 authorization-response issuer check (with the DoNotValidateResponseIssuer escape hatch), the avatar raster content-type allow-list (SVG refused), replay-cache enforcement on the account-linking callback, and SSO revocation via POST /sso/Unregister. Troubleshooting: the 'SSO response validation failed' cause and its per-provider relax.

    @iderex iderex committed Jul 13, 2026
  • Security Model: document optional rate limiting and write-only client secret

    @rekamer rekamer committed Jul 12, 2026
  • Document the OpenID id_token validation The Security Model page now describes the fail-closed id_token checks (JWKS signature under an asymmetric-only allowlist, issuer, audience/azp, lifetime, at_hash), and Troubleshooting gains the matching failure entry (HS256-signed tokens, clock drift, issuer mismatch, missing JWKS). Refs iderex/jellyfin-plugin-sso#134

    @iderex iderex committed Jul 12, 2026
  • Reflect yesterday's SAML/OIDC hardening in the security docs Security-Model gained the DTD/XXE-billion-laughs prohibition (PR #121), the OpenID state provider-binding and single-use replay guard (PR #56), the defensive response headers on the rendered auth page (PR #124), and the structured audit trail (PR #132) - none were reflected here yet. Troubleshooting's OpenID state lifetime was stale: it said about a minute, but PR #56 raised it to 15 minutes to accommodate provider-side MFA/consent.

    @iderex iderex committed Jul 12, 2026
  • Initial wiki: Home, Installation, Security Model, Troubleshooting

    @rekamer rekamer committed Jul 11, 2026