Tachiban 2.1.0 released

sharing
1

Hi,

Tachiban 2.1.0 is available.

I’ve implemented a few security fixes, enhanced the password reset process and fixed the custom values overriding bug.

Details from the change log:

Security fixes:

  • authenticated? no longer returns early when no user is found. It verifies the submitted password against a precomputed dummy hash instead, so existing and non-existing accounts take the same time to respond. This closes an account enumeration vulnerability where a valid email could be identified by a slower response.
  • authenticated? also handles a user record with a nil hashed_pass, and returns false for a nil password instead of raising.
  • password_reset_url_valid? now fails closed. It returns false for a nil user or a user with no password_reset_sent_at, where it previously raised NoMethodError.
  • session_expired? now returns true when session_start_time is missing, rather than raising. An undateable session is treated as expired.
  • Reset tokens are now 32 bytes (SecureRandom.urlsafe_base64(32)).

New methods:

  • verify_reset_token(token, link_validity_seconds: nil) — performs the blank-token check, the user lookup and the expiry check in the correct order and returns the user or nil. Recommended over calling password_reset_url_valid? directly.
  • reset_token_attributes — returns {token: nil, password_reset_sent_at: nil} for passing to the repo’s update method after a successful reset. Tachiban does not invalidate tokens by itself. Failing to clear them leaves reset links replayable indefinitely.

New feature — custom method hooks: Default values can now be overridden by defining private methods on your action instead of passing arguments. This makes defaults configurable for before callbacks like handle_session, which Hanami calls with a fixed argument list.

3 Likes