security: add rotation/expiry for the remote-access gRPC token #412

New issue

Open

opened 2026-07-21 00:06:04 +02:00 by dries · 0 comments

dries commented

2026-07-21 00:06:04 +02:00

Owner

Finding #6 (Low) from a security review.

Problem

The multi-remote gRPC bearer token is generated once and persisted forever — no rotation, no expiry (internal/state/identity.go). In -remote-trusted-overlay (plaintext grpc://) mode the token crosses the network in cleartext on every RPC. A single on-path capture yields a permanent credential equivalent to RCE on the remote (it can launch opencode in tmux). There is no way to invalidate it short of manual DB surgery.

Refs

internal/state/identity.go (token generation/persistence)
internal/remote/auth.go (bearer check)

Suggested fix

Add a "rotate remote token" action (endpoint + Settings > Remotes button) that regenerates the token via crypto/rand, invalidating the previous one. Optionally support an expiry/TTL.

Acceptance

Operator can rotate the token; old token is rejected afterward.
Rotation surfaced in the Remotes settings UI.
Test that a rotated-away token fails the interceptor.

Finding #6 (Low) from a security review. ## Problem The multi-remote gRPC bearer token is generated once and persisted forever — no rotation, no expiry (`internal/state/identity.go`). In `-remote-trusted-overlay` (plaintext `grpc://`) mode the token crosses the network in cleartext on every RPC. A single on-path capture yields a permanent credential equivalent to RCE on the remote (it can launch opencode in tmux). There is no way to invalidate it short of manual DB surgery. ## Refs - `internal/state/identity.go` (token generation/persistence) - `internal/remote/auth.go` (bearer check) ## Suggested fix Add a "rotate remote token" action (endpoint + Settings > Remotes button) that regenerates the token via `crypto/rand`, invalidating the previous one. Optionally support an expiry/TTL. ## Acceptance - Operator can rotate the token; old token is rejected afterward. - Rotation surfaced in the Remotes settings UI. - Test that a rotated-away token fails the interceptor.