auth

Jul 1, 2023 GO-2023-2065 +4 more

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

Changes in this version

+ func GenerateTokensAndSetCookies(c echo.Context, user *store.UserMessage, secret string) error

+ func RemoveTokensAndCookies(c echo.Context)

May 27, 2023 GO-2023-2036 +6 more

  GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

  GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

May 20, 2023 GO-2023-2036 +6 more

  GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

  GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

Apr 16, 2023 GO-2023-2036 +6 more

  GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

  GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

Apr 9, 2023 GO-2023-2036 +6 more

  GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

  GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

Changes in this version

+ const AccessTokenAudienceName

+ const RefreshTokenAudienceName

Apr 3, 2023 GO-2023-2036 +6 more

  GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

  GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos

  GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

  GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

  GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

  GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

  GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

Changes in this version

+ const AccessTokenAudienceFmt

+ const AccessTokenCookieName

+ const CookieExpDuration

+ const RefreshThresholdDuration

+ const RefreshTokenAudienceFmt

+ const RefreshTokenCookieName

+ const UserIDCookieName

+ func GenerateAPIToken(userName string, userID int, mode string, secret string) (string, error)

+ func GenerateAccessToken(userName string, userID int, mode string, secret string) (string, error)

+ func GenerateRefreshToken(userName string, userID int, mode string, secret string) (string, error)