stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Pin Web Push connections to validated public addresses #1097

Merged
rockachopa merged 1 commits from timmy/1096-pin-web-push-connections into main 2026-08-18 21:34:23 +00:00
Conversation 0 Commits 1 Files Changed 3 +168 -13
rockachopa commented 2026-08-18 21:26:52 +00:00
Member
Copy Link

Closes #1096

Pins each Web Push HTTPS connection to an address from its final public DNS validation while preserving the original hostname for Host, TLS SNI, and certificate verification. Environment proxies are disabled for this security boundary, redirects remain fail-closed, and connect-time rebinding removes only the unsafe device.

TDD evidence:

  • RED: transport test failed because send_web_push lacked a bound resolver.
  • RED: connect-time policy rejection left the unsafe subscription active.
  • GREEN: 51 focused tests pass.
  • Full suite: 2070 passed, 8 skipped.
Closes #1096 Pins each Web Push HTTPS connection to an address from its final public DNS validation while preserving the original hostname for Host, TLS SNI, and certificate verification. Environment proxies are disabled for this security boundary, redirects remain fail-closed, and connect-time rebinding removes only the unsafe device. TDD evidence: - RED: transport test failed because `send_web_push` lacked a bound resolver. - RED: connect-time policy rejection left the unsafe subscription active. - GREEN: 51 focused tests pass. - Full suite: 2070 passed, 8 skipped.
rockachopa added 1 commit 2026-08-18 21:26:53 +00:00
fix: pin Web Push connections to validated addresses (Closes #1096)
All checks were successful
CI / lint (pull_request) Successful in 2m52s
Details
CI / build-release (pull_request) Successful in 6s
Details
CI / browser-journey (pull_request) Successful in 2m57s
Details
CI / release-candidate (pull_request) Has been skipped
Details
ad40cb5fb9
rockachopa merged commit 19a1184b1c into main 2026-08-18 21:34:23 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#1097
No description provided.
Delete Branch "timmy/1096-pin-web-push-connections"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?