stackchain/stackchain-dashboard
2
0 Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Pin Web Push connections to validated public addresses #1097

Merged
rockachopa merged 1 commits from timmy/1096-pin-web-push-connections into main 2026-08-18 21:34:23 +00:00
Conversation 0 Commits 1 Files Changed 3
+168 -13
rockachopa commented 2026-08-18 21:26:52 +00:00
Member
Copy link
Copy source

Closes #1096

Pins each Web Push HTTPS connection to an address from its final public DNS validation while preserving the original hostname for Host, TLS SNI, and certificate verification. Environment proxies are disabled for this security boundary, redirects remain fail-closed, and connect-time rebinding removes only the unsafe device.

TDD evidence:

  • RED: transport test failed because send_web_push lacked a bound resolver.
  • RED: connect-time policy rejection left the unsafe subscription active.
  • GREEN: 51 focused tests pass.
  • Full suite: 2070 passed, 8 skipped.
Closes #1096 Pins each Web Push HTTPS connection to an address from its final public DNS validation while preserving the original hostname for Host, TLS SNI, and certificate verification. Environment proxies are disabled for this security boundary, redirects remain fail-closed, and connect-time rebinding removes only the unsafe device. TDD evidence: - RED: transport test failed because `send_web_push` lacked a bound resolver. - RED: connect-time policy rejection left the unsafe subscription active. - GREEN: 51 focused tests pass. - Full suite: 2070 passed, 8 skipped.
rockachopa added 1 commit 2026-08-18 21:26:53 +00:00
fix: pin Web Push connections to validated addresses (Closes #1096)
CI / lint (pull_request) Successful in 2m52s
Details
CI / build-release (pull_request) Successful in 6s
Details
CI / browser-journey (pull_request) Successful in 2m57s
Details
CI / release-candidate (pull_request) Has been skipped
Details
ad40cb5fb9
rockachopa merged commit 19a1184b1c into main 2026-08-18 21:34:23 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
Drop everything
 P1
High priority
 P2
Medium priority
 agent:nightprowl
Assignments routed to the LongCat NightProwl evaluation worker
 backend
Backend service
 ci
Continuous integration / actions
 frontend
Frontend / UI
 meta
Meta / planning
 pages
Gitea Pages
 template
Repo template / standards
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
nightprowl timmy (Timmy · the Wizard Mind) turdbot zephyrus-sparkborn (Zephyrus Sparkborn)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1097