security

Authentication and end-to-end encryption.

The E2EE handshake: the server signs a nonce with its RSA key so the client can verify it, then the client sends an RSA-OAEP wrapped AES-256-GCM key.
EncryptedRoute encrypts every JSON response with the session key and get_decrypted_request_body decrypts request bodies.
verify_token authenticates a request: another node acting for a user, the cookie of a web sign-in, a companion app's application key as a bearer (app.application_keys), a trusted proxy's header, or a key-file client's RS256 JWT, verified against the public key stored for the user.
Password hashing for public shares.

attributelogger

= logging.getLogger(__name__)

attributeALGORITHM

= 'RS256'

attributeJWT_LEEWAY_SECONDS

= 60

attributeHANDSHAKE_PATHS

= ('/api/handshake/initiate', '/api/handshake/exchange')

attributeMAX_CRYPTO_SESSIONS

= 4096

attributeIDEMPOTENCY_TTL_SECONDS

= 600

attributeHELD_SETTINGS

= {'persistent_storage': False, 'public_sharing': False, 'edit_templates': False, 'gpu': False, 'home_migration': False, 'session_limit': 0, 'pools': []}

attributeSTATUS_PATH

= '/api/admin/status'

attributeOWN_ORIGIN_NEEDED

= 'A session of a web sign-in opens on its own origin, <session id>.<domain>, apart from the web app. This server has no such name the browser reaches: it needs wildcard DNS and a certificate for it (see SEALSKIN_SESSION_DOMAIN and SEALSKIN_SESSION_ISOLATION).'

attributeWEB_CLIENT_NEEDED

= "A session of a web sign-in on the web app's origin is served by the server's copy of the application's web client, which this server could not export from the image (see SEALSKIN_WEB_CLIENT_PATH)."

EncryptedRoute