fix: mitigate SSO session fixation with postMessage verification#2447
fix: mitigate SSO session fixation with postMessage verification#2447chaitanyapotti wants to merge 3 commits intomasterfrom
Conversation
Add postMessage as a secure direct channel between the OAuth popup and the DApp window, with SecurePubSub retained as a fallback for browsers where window.opener is unavailable (e.g. COOP headers). The authConnector now listens for a postMessage from the auth service popup, validates origin and nonce, and sends an ACK back. If the popup receives the ACK within 100ms, it skips the SecurePubSub dapp channel entirely, eliminating the session fixation attack vector.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| reject(error); | ||
| } | ||
| isClosedWindow = true; | ||
| securePubSub.cleanup(); |
There was a problem hiding this comment.
Successful postMessage login triggers false failed audit
Low Severity
When the postMessage path succeeds (no error), handleLoginFinished calls securePubSub.cleanup() while the SecurePubSub .subscribe() promise is still pending. If cleanup() causes the pending subscription to reject, the .catch() handler fires and calls auditOAuditProgress(loginParams, "failed") — recording a false "failed" audit for a login that actually succeeded. In the original code, securePubSub.cleanup() in the success path was only ever called inside the .subscribe().then() callback, meaning the subscription had already resolved and cleanup() couldn't trigger the .catch() handler.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 4dca2b0. Configure here.
Add postMessage as a secure direct channel between the OAuth popup and the DApp window, with SecurePubSub retained as a fallback for browsers where window.opener is unavailable (e.g. COOP headers). The authConnector listens for postMessage from the auth service popup, validates origin and nonce, sends an ACK back, and forwards the OAuth data to the Auth iframe. If the popup receives the ACK within 100ms, it skips SecurePubSub entirely.
…3Auth/web3auth-web into fix/sso-session-fixation-postmessage
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f7f8365. Configure here.
| window.removeEventListener("message", handlePostMessage); | ||
| this.authInstance.postLoginCancelledMessage(nonce); | ||
| reject(error); | ||
| }); |
There was a problem hiding this comment.
Window open failure leaves SecurePubSub and state uncoordinated
Low Severity
The verifierWindow.open().catch() handler rejects the promise but does not set loginFinished = true or call securePubSub.cleanup(). Since loginFinished remains false, a later SecurePubSub message or close event can still invoke handleLoginFinished, which calls postLoginCancelledMessage a second time and attempts redundant cleanup on an already-settled promise.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit f7f8365. Configure here.
1 participant
Jira Link
N/A — Security vulnerability report response
Description
Mitigates an SSO session fixation vulnerability in the popup login flow. The attack exploits SecurePubSub's server-side relay architecture: an attacker initiates OAuth, extracts the authorization URL, sends it to a victim, and receives the victim's credentials through the shared SecurePubSub channel.
Changes:
postMessageevent listener inconnectWithSocialLoginthat receiveslogin_finisheddirectly from the popup viawindow.opener.postMessage()WEB3AUTH_LOGIN_ACKback to the popup so it can skip the SecurePubSub dapp channelwindow.openeris unavailable (e.g. COOP headers)Companion PR: Web3Auth/auth-service — sends the
postMessagefrom the popup callback page and waits for ACK before deciding whether to use SecurePubSub.How has this been tested?
Types of changes
Checklist
Note
High Risk
Changes the OAuth popup completion path in
AuthConnector.connectWithSocialLogin, which is part of the authentication flow and security-sensitive. Incorrect origin/nonce handling or cleanup could break logins or reintroduce session-fixation style issues.Overview
Mitigates a popup OAuth session-fixation vector by preferring a direct
window.postMessagesignal from the auth-service popup over the sharedSecurePubSubrelay channel.connectWithSocialLoginnow listens forweb3auth_login_finishedmessages, validates origin (auth service) and nonce, sends aweb3auth_login_ackback to the popup, optionally forwards OAuth data to the auth iframe, and centralizes cleanup to ensure listeners/popup/pubsub are closed exactly once while retainingSecurePubSubas a compatibility fallback whenwindow.openeris unavailable.Reviewed by Cursor Bugbot for commit f7f8365. Bugbot is set up for automated code reviews on this repo. Configure here.