Repository navigation
release: 0.7.1, serve refuses to bind beyond loopback without a bearer token (--allow-no-token permits it) - #13
Merged
Merged
Conversation
…en permits it) `serve`, `daemon` and `serve-fleet` check at startup, before the wallet is opened or any socket is bound: an address beyond loopback (BIND_ADDR) with no AUTH_TOKEN (an empty one counts as none) is refused with one error naming `--allow-no-token`, the flag that permits the open bind deliberately. A loopback bind without a token is unchanged. Since 0.7.0 the two BEEF doors take a body of any size, so an open daemon with no token held any body any host sent. The three copies of the BIND_ADDR read are one, `server::bind_addr_from_env`, so the guard and the bind read the same address. Witness `tests/serve_bind_guard.rs`: red at 6fd9d0d (serve bound 0.0.0.0 open; `--allow-no-token` an unexpected argument), green here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README's HTTP server section says so in two sentences and its AUTH_TOKEN and BIND_ADDR rows say the same; the CHANGELOG names the risk it closes (an open daemon with no token, the BEEF doors uncapped since 0.7.0) and the upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The captain's call on the 0.7.0 lane's one risk (bsv-stack-lean docs/p0/align-cli.md): a served daemon with no bearer token holds any body a client sends, so a bind beyond 127.0.0.1 without a token is refused at startup with one plain error naming the one flag that permits it; loopback without a token is unchanged. A limit for abuse and never for correctness (docs/BSV-NORTH-STAR.md section 3). Witness tests/serve_bind_guard.rs red at 6fd9d0d; 338 tests, fmt, clippy, the vectors, the dry run (docs/p0/cli-0.7.1.md). The fleets set their token before they move.
🤖 Generated with Claude Code