Follow-up to N97 (access token + device id in plaintext localStorage). On the Tauri desktop app this is solvable now: keep the token in the OS keychain (Windows Credential Manager / macOS Keychain / Secret Service) and out of the webview's storage; optionally add an idle lock that re-authenticates via the OS after N minutes.
Research first — do not implement until the findings are reviewed. Required outputs:
Map every read/write of the session in src/app/state/sessions.ts, src/client/initMatrix.ts, src/sw-session.ts (the service worker needs the token for authenticated media — how does it get it if the token is not in localStorage?), the OIDC callback, multi-tab logout sync, and cinny-desktop's Rust side.
Evaluate tauri-plugin-stronghold vs tauri-plugin-keyring/keyring crate; Linux Secret Service availability on headless/portable installs; behaviour when the keychain is locked or denied.
Migration path for existing installs (token currently in localStorage → move → wipe), and rollback.
Whether the rust-crypto IndexedDB store needs the token (it does not — confirm) and how the web PWA remains unchanged.
Threat model note: what this defends against (XSS token exfiltration, disk reads by other users) and what it does not.
Deliverable: a written plan in this issue; implementation is a separate issue once approved.
Follow-up to N97 (access token + device id in plaintext `localStorage`). On the Tauri desktop app this is solvable now: keep the token in the OS keychain (Windows Credential Manager / macOS Keychain / Secret Service) and out of the webview's storage; optionally add an idle lock that re-authenticates via the OS after N minutes.
**Research first — do not implement until the findings are reviewed.** Required outputs:
1. Map every read/write of the session in `src/app/state/sessions.ts`, `src/client/initMatrix.ts`, `src/sw-session.ts` (the service worker needs the token for authenticated media — how does it get it if the token is not in localStorage?), the OIDC callback, multi-tab logout sync, and cinny-desktop's Rust side.
2. Evaluate `tauri-plugin-stronghold` vs `tauri-plugin-keyring`/`keyring` crate; Linux Secret Service availability on headless/portable installs; behaviour when the keychain is locked or denied.
3. Migration path for existing installs (token currently in localStorage → move → wipe), and rollback.
4. Whether the rust-crypto IndexedDB store needs the token (it does not — confirm) and how the web PWA remains unchanged.
5. Threat model note: what this defends against (XSS token exfiltration, disk reads by other users) and what it does not.
Deliverable: a written plan in this issue; implementation is a separate issue once approved.
jared
added this to the Features 2026-Q4 milestone 2026-09-17 01:39:34 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to N97 (access token + device id in plaintext
localStorage). On the Tauri desktop app this is solvable now: keep the token in the OS keychain (Windows Credential Manager / macOS Keychain / Secret Service) and out of the webview's storage; optionally add an idle lock that re-authenticates via the OS after N minutes.Research first — do not implement until the findings are reviewed. Required outputs:
src/app/state/sessions.ts,src/client/initMatrix.ts,src/sw-session.ts(the service worker needs the token for authenticated media — how does it get it if the token is not in localStorage?), the OIDC callback, multi-tab logout sync, and cinny-desktop's Rust side.tauri-plugin-strongholdvstauri-plugin-keyring/keyringcrate; Linux Secret Service availability on headless/portable installs; behaviour when the keychain is locked or denied.Deliverable: a written plan in this issue; implementation is a separate issue once approved.