Skip to content

Private Landing v1.2.0

Choose a tag to compare

View all tags
@vhscom vhscom released this 15 Feb 16:25
· 61 commits to main since this release
1.2.0
This tag was signed with the committer’s verified signature.
vhscom
GPG key ID: E7788EBA96876C6A
Verified
Learn about vigilant mode.
2bfae1c
This commit was signed with the committer’s verified signature.
vhscom
GPG key ID: E7788EBA96876C6A
Verified
Learn about vigilant mode.

🔑 Password Change Endpoint

This release adds a secure password change endpoint with full session revocation, closing a critical production gap.

What's New

  • 🔄 Password Change Endpoint
    POST /api/account/password with current password re-verification, PBKDF2 rehash with fresh salt, and atomic revocation of all sessions (ADR-004)

  • 🚪 Bulk Session Revocation
    endAllSessionsForUser on SessionService interface — works on both SQL and cache-backed implementations

  • 📋 Password Change Schema
    passwordChangeSchema with cross-field refinement rejecting no-op changes (current === new)

Security Properties

  • Timing-safe rejection — non-existent users trigger full PBKDF2 against a dummy hash to equalize
    response time
  • Generic error messages — "Password change failed" for both wrong password and missing account
  • Full session revocation — all sessions expired atomically, including the current one
  • Current password required — session-only access cannot escalate to credential takeover (OWASP
    ASVS v5.0 §6.2.3, NIST SP 800-63B §5.1.1.2)

Documentation

  • ADR-004: password change endpoint decision record with OWASP ASVS v5.0 and NIST SP 800-63B references
  • Security audit report for password change implementation
  • Updated auth flow diagrams with password change sequence
  • Updated threat model with password change threats and OWASP ASVS v5.0 references
  • CLAUDE.md: added password change to key design decisions, added cache enablement shortcut

Test Coverage

  • 315 unit tests, 63 integration tests (378 total, up from 361)
  • Integration tests cover: success path, session revocation, re-login with new password, wrong current password, same-password rejection, auth requirement, content negotiation

Packages (v1.2.0)

  • @private-landing/core
  • @private-landing/infrastructure
  • @private-landing/schemas
  • @private-landing/types
  • @private-landing/cloudflare-workers

Intended Use

Private Landing is intended for:

  • Education & learning around modern authentication systems
  • Reference architecture for Cloudflare Workers
  • Bootstrapping custom authentication implementations
  • Security review and discussion

It is not a turnkey production authentication service.

Stability

Private Landing v1.2.0 adds password change as a new capability. No existing behavior has changed.
SQL-backed sessions remain the default.

Assets 2
Loading