Description
com.whtwnd.blog.notifyOfNewEntry (the Lambda handler at backend/xrpc/com_whtwnd_blog_notifyOfNewEntry/main.go) accepts any POST with a valid AT URI format and immediately indexes the entry into DynamoDB — with no authentication or authorization check.
The code has an acknowledged // TODO: validate actor did comment but no implementation.
Impact
Any unauthenticated caller can:
- Submit arbitrary AT URIs to be indexed
- Poison the blog metadata index with fake entries
- Cause excess DynamoDB write costs
Suggested fix
Verify the AT Protocol Authorization header (XRPC auth) and confirm the caller's DID matches the authority portion of the submitted AT URI before indexing.
Related PR
A CORS restriction (limiting cross-origin callers) is in PR #163 as a partial mitigation, but proper authentication is still needed.
Description
com.whtwnd.blog.notifyOfNewEntry(the Lambda handler atbackend/xrpc/com_whtwnd_blog_notifyOfNewEntry/main.go) accepts any POST with a valid AT URI format and immediately indexes the entry into DynamoDB — with no authentication or authorization check.The code has an acknowledged
// TODO: validate actor didcomment but no implementation.Impact
Any unauthenticated caller can:
Suggested fix
Verify the AT Protocol Authorization header (XRPC auth) and confirm the caller's DID matches the
authorityportion of the submitted AT URI before indexing.Related PR
A CORS restriction (limiting cross-origin callers) is in PR #163 as a partial mitigation, but proper authentication is still needed.