Skip to content

security: unauthenticated notifyOfNewEntry endpoint allows index spam #165

Description

@Cache8063

Description

com.whtwnd.blog.notifyOfNewEntry (the Lambda handler at backend/xrpc/com_whtwnd_blog_notifyOfNewEntry/main.go) accepts any POST with a valid AT URI format and immediately indexes the entry into DynamoDB — with no authentication or authorization check.

The code has an acknowledged // TODO: validate actor did comment but no implementation.

Impact

Any unauthenticated caller can:

  • Submit arbitrary AT URIs to be indexed
  • Poison the blog metadata index with fake entries
  • Cause excess DynamoDB write costs

Suggested fix

Verify the AT Protocol Authorization header (XRPC auth) and confirm the caller's DID matches the authority portion of the submitted AT URI before indexing.

Related PR

A CORS restriction (limiting cross-origin callers) is in PR #163 as a partial mitigation, but proper authentication is still needed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions