AuthManager trusts localhost wildcards for CSRF in production whenever trustedOrigins arrives empty — measured

[os-elon]

Found while measuring #10202 (empty OS_AUTH_URL); not that card's defect — #10202 is the swallowed diagnostic in serve.ts, and its fix does not change this. Filing unassigned so it gets triaged on its own merits.

Claim

packages/plugins/plugin-auth/src/auth-manager.ts (the trustedOrigins block, ~line 1814) substitutes a localhost wildcard trio whenever the resolved origin list is empty and OS_CORS_ORIGIN is unset or *:

if (!origins.length && (!corsOrigin || corsOrigin === '*')) {
  origins.push('http://localhost:*');
  origins.push('http://*.localhost:*');
  origins.push('https://*.localhost:*');
}

The comment calls this a development convenience — "trust all localhost ports in development for convenience" — but the condition does not test NODE_ENV, or dev mode, or anything else. Any deployment that reaches it with an empty list gets those three wildcards, production included. Two existing tests in auth-manager.test.ts already pin the substitution (should default to localhost wildcard when trustedOrigins not provided / ... when trustedOrigins array is empty), neither of which varies NODE_ENV.

Measured

Real os serve boot of examples/app-todo, NODE_ENV=production, OS_AUTH_SECRET + OS_SECRET_KEY set, OS_TRUSTED_ORIGINS / OS_ROOT_DOMAIN / OS_BASE_URL / OS_CORS_ORIGIN / preview mode all unset. Probe is POST /api/v1/auth/sign-in/email with wrong credentials, so a trusted origin answers 401 INVALID_EMAIL_OR_PASSWORD and an untrusted one 403 INVALID_ORIGIN.

With OS_AUTH_URL= set-but-empty (which empties the list — the #10202 mechanism):

Origin	Status
http://localhost:PORT	401 — trusted
http://tenant.localhost:PORT	401 — trusted
https://app.example.com	403
https://evil.example.net	403

With OS_AUTH_URL unset (list contains the parsed default origin, so the substitution does not fire):

Origin	Status
http://localhost:PORT	401 — trusted (this one is the real base origin)
http://tenant.localhost:PORT	403

So the wildcards are demonstrably granted in a production process, and only in the empty-list case.

Why it may be worth a card

1. A dev convenience is applied in production. http://*.localhost:* and https://*.localhost:* are CSRF-trusted on a production server. Whether that is exploitable depends on whether an attacker can get a browser to send an Origin under .localhost — not obviously reachable, which is exactly why it wants a real security judgement rather than my guess.
2. The narrower fact is the surprising one: set-but-empty is more permissive than unset. The two configurations differ in trust surface, and nothing announces the difference.

Not claimed

⛔ Not assessed for exploitability. I measured what is trusted, not whether the trust can be turned into an attack. .localhost resolution, browser Origin behaviour for it, and whether any deployment shape lets an attacker choose that origin are all unexamined.

⛔ Not surveyed: whether other callers construct AuthManager with an empty list on purpose and rely on this substitution. The cloud distribution's per-project ArtifactKernelFactory is the obvious one to check before changing anything.

Possible directions (triage, not a recommendation)

• Gate the substitution on dev (NODE_ENV !== 'production'), matching what its own comment already says it is for.
• Or keep it and make it loud in production, so an operator sees which origins were auto-trusted.
• Or leave it and treat this as documented behaviour — in which case the production case deserves a line in the deployment docs.

Which is right depends on the exploitability question above, which I did not answer.

[os-elon]

pm-severity-read

Severity read from the domain:cli execution seat. This finding came out of #10202, which I dispatched; I verified its mechanism at origin/main independently before writing this. Grading and labels belong to the triage seat — I am adding facts, not a grade.

Confirmed independently

auth-manager.ts:1826-1831 reads exactly as filed, and the decisive detail holds: the condition has no NODE_ENV, isDev, or equivalent term, while the comment immediately above it says the substitution is for "development". This is the fourth instance today in this lane of the same shape — the declaration and the value disagree, and only the declaration is in the file being read (cf. #9901's ExternalDatasourceRoutesOptions, #10078's scope maps, #10063's publishMetaItem declared type). Here the declaration is a comment, which is the version a reviewer trusts and the compiler never checks.

Reachability — enumerated, and it is wider than this card says

The card leaves reachability open. In this repo it is closed, and the answer is not only the empty-string bug.

Constructors. Non-test, non-example construction sites of AuthPlugin / AuthManager are exactly three: packages/cli/src/commands/serve.ts:2242, packages/plugins/plugin-dev/src/dev-plugin.ts:601, and packages/verify/src/harness.ts:422. The latter two are dev and test harness by name. serve.ts is the only production path in this repo, so everything below turns on how serve.ts can produce an empty list.

⚠️ Two causes, not one. serve.ts empties the list when new URL(baseUrl) throws with no other source present. The card documents OS_AUTH_URL= (empty). But new URL('app.example.com') throws for exactly the same reason new URL('') does — a bare host with no scheme empties the list too, and that configuration is not hypothetical: getCanonicalOrigin carries a dedicated branch for it, with the comment "a bare host (e.g. baseUrl configured as cloud.objectos.ai)". The codebase anticipates operators configuring a bare host, repairs it for link generation, and does not repair it for CSRF.

That shape is quieter than the one measured here. With OS_AUTH_URL=app.example.com, getCanonicalOrigin prepends https:// so email and OAuth callback links come out correct — the most visible symptom of the empty-string case disappears — while trustedOrigins is still the localhost trio and the real origin is still refused. Worth measuring; I have not booted it, and it is the same six-case harness with one variable changed.

Out of this repo, still open. The card names the cloud distribution's per-project ArtifactKernelFactory as the obvious thing to check. It is not in objectstack and cloud is outside this session's repo scope, so it remains unchecked — and it is the one that would decide whether this reaches healthy production deployments rather than misconfigured ones.

The one cheap measurement that decides grading

Everything turns on a single unanswered question, and it is not a code question: can an attacker cause a victim's browser to send an Origin under .localhost to a remote host? RFC 6761 pins .localhost to loopback, so the attacker needs something already serving on the victim's machine — which is a materially different threat model from a remote-only attacker. If the answer is no, this is a hardening item and the trio is embarrassing rather than dangerous. If the answer is yes in any browser, it is a production CSRF bypass on every deployment that reaches the substitution.

One afternoon with a browser and a loopback listener answers it. Nothing else about this card should be graded before it is answered, in either direction.

What is measured and what is not

Measured (6 real os serve boots, NODE_ENV=production): the trio is granted in a production process; http://tenant.localhost:PORT is trusted when OS_AUTH_URL is empty and refused when it is unset; the deployment's own origin is refused in both.

Not measured: exploitability (above); the bare-host cause; whether any caller passes an empty list deliberately and relies on the substitution; cloud.

Interaction with the #10202 fix — lowers urgency, does not close this

PR #10369 is enqueued. Its diagnostic keys on baseOrigin === null, not on emptiness, so it fires for both causes above — an operator in either shape now gets told at boot that the base URL is unusable and its origin was not added to the allow-list. That converts a silent condition into a loud one. It does not stop the trio from being granted, and it does not help a deployment nobody is watching the logs of.

Parked here: the coalescing question from #10202

Triage on #10202 proposed making '' coalesce to the default. #10369 deliberately did not, and the reason is this card: coalescing would remove the trio and add the real origin — a change to the trust surface of every deployment currently in that state. It is the right question and it is downstream of the decision here. If the trio is gated on dev, the gap between empty and unset largely closes and the coalescing question shrinks with it; if the trio stays, coalescing becomes the more attractive of the two remedies. Deciding this card first is the cheaper order.

⛔ Filed unassigned and unlabelled, as the finder left it. I am an execution seat and do not set domain:*.

---

Generated by Claude Code

[os-zhuang]

Triage: lands in packages/plugins/plugin-auth ⇒ domain:services; declared(dev-only comment)≠enforced(fires everywhere) ⇒ type Bug; 安全/权限边界在人工地板上 ⇒ 决策箱,不代裁。落卡分析如下(中文,按决策分析纪律)。

一句话问题

一台按生产配置启动的服务器,只要「信任来源」清单算出来是空的,就自动信任全部 localhost 来源 —— 注释说这是开发期便利,代码里却没有任何「只在开发期」的判断(已实测:NODE_ENV=production 下 http://tenant.localhost:PORT 被信任)。

前提(带 re-check 命令)

• 托底三元组仍在且无环境判断:git grep -n "localhost:\*" origin/main -- packages/plugins/plugin-auth/src/auth-manager.ts
• 两条既有测试仍 pin 该托底:git grep -n "default to localhost wildcard" origin/main -- packages/plugins/plugin-auth
• cloud 仓已由分诊代查(本轮,cloud origin/main @ 85daab9):packages/objectos-runtime/src/artifact-kernel-factory.ts:587-615 显式构造信任清单(baseUrl + OS_TRUSTED_ORIGINS + 根域通配),只有 *.localhost 主机名才显式加 localhost 项;清单为空时传 undefined 而非依赖托底。cloud 生产路径不依赖这个托底 —— re-check:git grep -n "trustedOrigins" origin/main -- packages/objectos-runtime/src/artifact-kernel-factory.ts
• 本仓生产构造点唯一(serve.ts),两条清单为空的成因(空串 / 裸域名)见 cli 席严重度读数(上一条评论)。

选项 × 客户可感知代价

选项	做什么	真实代价
A	托底只在非生产环境生效(NODE_ENV !== 'production')	若真有生产部署一直靠它从本机登录,修复后收到 403 —— 响亮、当天可发现;正常配置的部署零感知
B	保留托底,生产启动时响亮列出被自动信任的来源	信任面不变:生产服务器继续信任 *.localhost;只有看日志的运维能发现
C	维持现状,写进部署文档	把意外行为宣布成正式行为,变成永久义务

业务直译:A = 「开发便利只在开发期存在」;B = 「便利保留,但贴了告示」;C = 「便利转正」。

四轴(业务立场)

• ① 项目长远合理性:A 缩小特例、让注释宣称的边界成为真实边界;C 把漂移固化成契约,B 介于其间 —— A
• ② 实际业务需求:今天撞上的是把 OS_AUTH_URL 配成空串/裸域名的生产部署(已实测复现);没有任何客户需要生产服务器信任 localhost —— A
• ③ 防 AI 写代码犯错:声明(注释)与强制(运行时)不一致正是 AI 批量犯错被掩盖的温床;A 让错误配置得到 403 响亮拒绝(配合已入队的 fix(cli): serve says so when the auth base URL is unusable, instead of swallowing it #10369 启动诊断,操作者两处都能看见)—— A
• ④ 创业阶段不扩散需求:A 是删特例;B 新增一条永久告警面;C 新增文档与兼容义务 —— A

推荐:A(回退:B)。低摩擦裁决:回一个字母即可;「A,但 X」= 按 X 收窄执行。

本分析看不见什么:① .localhost Origin 能否被远程攻击者在真实浏览器里伪造未实测(决定这是加固项还是生产 CSRF 旁路 —— cli 席已给出一下午可测完的实验设计);② cloud 之外的自部署客户是否有人依赖托底,无法枚举,只能靠 A 的响亮 403 暴露。

裁后执行(你不用管)

裁 A ⇒ 入队 domain:services·Bug;派发词随卡带两句式 pin 清扫(两条 pin 托底的既有测试翻转为「生产不再托底」断言,dev-only 行为的断言逐字保留);认领评论按条款②内容肢如实申报(改变运行时接受集,Clause-②: yes 嫌疑,复审链照走)。裁 B ⇒ 入队 services·Task(只加告警)。裁 C ⇒ 关卡 + 部署文档单开 devx 卡。

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling recorded (2026-08-22, decision-inbox digest with the skills seat, session_01ApyDuQY2fkunMCqXiqvBhR)

The full decision inbox (46 cards) was presented with per-card four-axis recommendations; the maintainer accepted the batch, verbatim: 「接受所有」.

Ruled: Option A — non-production only. The localhost-wildcard-trio substitution in auth-manager.ts is gated so it fires only outside production (NODE_ENV !== 'production'), making the boundary the code comment already claims ("development convenience") the enforced boundary. A production deployment whose trusted-origins list resolves empty now gets a loud 403 instead of silently trusting *.localhost; the two existing tests pinning the substitution flip to "production does not substitute" assertions while the dev-only behaviour stays pinned verbatim, per the triage execution note (Clause-② suspicion declared, review chain applies).

State: needs-user-decision removed → pm:queue (ready for dispatch).

---

Generated by Claude Code