Security: harden auth, CSRF, SSRF, XSS, and env race conditions

[betamod]

Security Audit -- 12 Fixes

Full security review of the Hermes WebUI codebase. All fixes are backward-compatible with no breaking changes.

CRITICAL

• CSRF protection -- All POST endpoints now validate Origin/Referer against Host. Prevents cross-origin abuse of self-update, settings changes, file operations, and password changes.

HIGH

• Password hashing unified -- save_settings() was using single-iteration SHA-256. Now calls auth._hash_password() (PBKDF2-HMAC-SHA256, 600k iterations).
• Login rate limiting -- 5 attempts per 60 seconds per IP. Returns 429 on excess.

MEDIUM

• Session ID validation -- Session.load() rejects non-hex chars before filesystem operations. Prevents path traversal via crafted session ID.
• SSRF DNS resolution -- get_available_models() now resolves DNS before checking private IPs. Prevents DNS rebinding attacks.
• Non-loopback warning -- Startup warning when binding to 0.0.0.0 without a password set (common Docker footgun).
• ENV LOCK consistency -- _ENV_LOCK now wraps all os.environ mutations in both sync chat and streaming restore blocks.
• Stored XSS prevention -- Forces Content-Disposition: attachment for HTML/XHTML/SVG MIME types.

LOW

• HMAC signature -- Extended from 64 to 128 bits.
• Skills path validation -- resolve().relative_to(SKILLS_DIR) check after path construction.
• Secure cookie flag -- Auto-set when TLS or X-Forwarded-Proto: https detected.
• Error message sanitization -- _sanitize_error() strips absolute filesystem paths from exception messages.

Files Changed

• api/auth.py (+27/-2) -- rate limiter, HMAC, Secure flag
• api/config.py (+26/-4) -- PBKDF2, SSRF DNS check
• api/helpers.py (+9) -- error sanitizer
• api/models.py (+3) -- session ID validation
• api/routes.py (+85/-38) -- CSRF, ENV LOCK, XSS, skills validation, sanitized errors
• api/streaming.py (+17/-7) -- ENV LOCK on restore
• server.py (+8) -- non-loopback warning

[nesquena]

Independent Review: PR #171 — Security Hardening (12 fixes)

Thorough security PR from @betamod. Reviewed all 12 fixes individually.

All 12 fixes are legitimate and well-implemented:

#	Fix	Verdict
1	CSRF Origin/Referer validation	Good — standard pattern, allows non-browser clients
2	PBKDF2 password hashing (600k iterations)	Good — replaces weak single-iteration SHA-256
3	Login rate limiting (5/60s per IP)	Good — clean implementation
4	Session ID hex-only validation	Good — prevents path traversal via crafted IDs
5	SSRF DNS resolution check	Good — prevents DNS rebinding, allows known local providers
6	Non-loopback startup warning	Good — catches common Docker footgun
7	ENV_LOCK on sync chat path	Good — matches existing streaming path pattern
8	Content-Disposition for HTML/SVG	Good — prevents stored XSS via uploads
9	HMAC signature 64→128 bits	Good — minor improvement
10	Skills path resolve()+relative_to()	Good — prevents traversal
11	Secure cookie flag	Had a bug — fixed (see below)
12	Error path sanitization	Good — regex strips filesystem paths

Bug found and fixed

Secure cookie detection (auth.py line 181): handler.request.getpeercert raises AttributeError on plain sockets — non-SSL socket.socket objects don't have that method. Pushed a fix using getattr(handler.request, 'getpeercert', None) which safely returns None for plain sockets and the method object for SSL sockets.

Tests

442 passed, 0 failed, 24 skipped. No regressions.

[betamod]

Thanks very much!

[nesquena-hermes]

Review complete — merged as v0.39.0 via PR #172

Reviewed all 12 fixes end-to-end. All are legitimate, well-implemented, and backward-compatible. Summary:

#	Fix	Verdict
1	CSRF Origin/Referer validation	✅ Clean implementation — non-browser clients unaffected
2	PBKDF2 password hashing (600k iterations)	✅ Replaces weak single-iteration SHA-256
3	Login rate limiting (5/60s per IP)	✅ In-memory rate limiter, correct sliding window
4	Session ID hex-only validation	✅ Prevents path traversal via crafted session IDs
5	SSRF DNS resolution check	✅ Prevents DNS rebinding; known local providers whitelisted
6	Non-loopback startup warning	✅ Catches common Docker footgun
7	ENV_LOCK on sync chat path	✅ Consistent with streaming path pattern
8	Content-Disposition for HTML/SVG	✅ Prevents stored XSS via uploads
9	HMAC signature 64→128 bits	✅ Clean improvement
10	Skills path resolve()+relative_to()	✅ Prevents traversal
11	Secure cookie flag (getattr fix applied)	✅ Safe on plain sockets
12	Error path sanitization	✅ Regex strips filesystem paths

What was added before merge

• Rebased on master (branch was behind by 5 commits from v0.38.5; cherry-picked cleanly, no conflicts)
• 33 tests in tests/test_sprint29.py covering all 12 fixes — all green
• Version bump: v0.38.6 → v0.39.0 with full CHANGELOG entry

Final results

499 tests passed, 0 failed.

Thanks @betamod — solid security work.